VAR-201401-0557
Vulnerability from variot - Updated: 2025-04-11 23:10Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series with firmware 11.19.85_1FE3A allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the HTTP_PORT parameter. Lorex Security DVR Edge Series is the Edge series of digital video recorder products from Lorex Technologies of the United States. A remote buffer overflow vulnerability exists in Lorex Security DVR Edge Series. Failed exploit attempts will result in a denial-of-service condition. Hi,
I have discovered a buffer overflow vulnerability that allows remote code execution in an ActiveX control bundled by a manufacturer of video surveillance systems. The company is Lorex Technologies, a major video surveillance manufacturer that is very popular in the US and East Asia. I have confirmed that all 16 are vulnerable at this point in time. The Lorex manual[1] instructs the user to blindly accept the ActiveX control install when prompted. The full list of devices, as well as links to the firware download, can be found in [2]. Their products offer remote video viewing capabilities, and you can find some of them on Shodan[3].
The buffer overflow can be triggered by a really long string (10000+ characters) in the HTTP_PORT parameter. The instruction pointer can be very easily controlled in XP by the characters 109 to 113 in the string. Please refer to the PoC file lorex-testcase.html. You will see that the HTTP_PORT parameter is composed of D's, apart from chars 109 to 113 which are four A's. If you open this file in IE after installing the control, you will see that IE will crash with an EIP of 0x41414141. Changing the four A's to any other value will cause EIP to crash on that value.
The list below tells a better story about what is affected and how it can be controlled: Win XP SP3 with IE6 - Fully exploitable as described Win XP SP3 with IE8 - Could not get it to crash (????) Win 7 x64 with IE10 fully patched - Fully exploitable, though not as easy as for XP (see analyze -v [4] and !exploitable [5] outputs)
To verify this vulnerability you can download and extract the firmware using binwalk (http://code.google.com/p/binwalk/). To do so, please follow the instructions in [6], and then install the ActiveX control in INetViewProj1_02030330.cab.
I have contacted Lorex and they initially said they would fix it, but went radio silent shortly afterwards. 17.11.2013 - Initial contact via support page 18.11.2013 - Email to sales, no response. 21.11.2013 - Second email to sales, received response by sales saying they will forward it to technical support and get back to me. 04.12.2013 - Third email to sales saying that technical support never contacted me back. No response. 08.01.2013 - MITRE assigns CVE-2014-1201 to this issue. 09.01.2013 - Public disclosure.
All references can be found at: https://github.com/pedrib/PoC/lorexActivex/lorex-report.txt
Proof of concept: https://github.com/pedrib/PoC/lorexActivex/lorex-testcase.html
Regards, Pedro Ribeiro (pedrib@gmail.com) Agile Information Security
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "edge lh310",
"scope": "eq",
"trust": 1.6,
"vendor": "lorex",
"version": "7-35-28-1b26e"
},
{
"_id": null,
"model": "edge3 lh340",
"scope": "eq",
"trust": 1.6,
"vendor": "lorex",
"version": "11.19.85_1fe3a"
},
{
"_id": null,
"model": "edge\\+ lh320",
"scope": "eq",
"trust": 1.6,
"vendor": "lorex",
"version": "7-35-28-1b26e"
},
{
"_id": null,
"model": "edge2 lh330",
"scope": "eq",
"trust": 1.6,
"vendor": "lorex",
"version": "11.17.38-33_1d97a"
},
{
"_id": null,
"model": "edge\\+",
"scope": "eq",
"trust": 1.0,
"vendor": "lorextechnology",
"version": "lh320"
},
{
"_id": null,
"model": "edge",
"scope": "eq",
"trust": 1.0,
"vendor": "lorextechnology",
"version": "lh310"
},
{
"_id": null,
"model": "edge2",
"scope": "eq",
"trust": 1.0,
"vendor": "lorextechnology",
"version": "lh330"
},
{
"_id": null,
"model": "edge3",
"scope": "eq",
"trust": 1.0,
"vendor": "lorextechnology",
"version": "lh340"
},
{
"_id": null,
"model": "edge",
"scope": "eq",
"trust": 0.8,
"vendor": "lorex",
"version": "lh310 series"
},
{
"_id": null,
"model": "edge lh310 series",
"scope": "eq",
"trust": 0.8,
"vendor": "lorex",
"version": "7-35-28-1b26e"
},
{
"_id": null,
"model": "edge+",
"scope": "eq",
"trust": 0.8,
"vendor": "lorex",
"version": "lh320 series"
},
{
"_id": null,
"model": "edge+ lh320 series",
"scope": "eq",
"trust": 0.8,
"vendor": "lorex",
"version": "7-35-28-1b26e"
},
{
"_id": null,
"model": "edge2",
"scope": "eq",
"trust": 0.8,
"vendor": "lorex",
"version": "lh330 series"
},
{
"_id": null,
"model": "edge2 lh330 series",
"scope": "eq",
"trust": 0.8,
"vendor": "lorex",
"version": "11.17.38-33_1d97a"
},
{
"_id": null,
"model": "edge3",
"scope": "eq",
"trust": 0.8,
"vendor": "lorex",
"version": "lh340 series"
},
{
"_id": null,
"model": "edge3 lh340 series",
"scope": "eq",
"trust": 0.8,
"vendor": "lorex",
"version": "11.19.85_1fe3a"
},
{
"_id": null,
"model": "activex control",
"scope": null,
"trust": 0.6,
"vendor": "lorex lorex",
"version": null
},
{
"_id": null,
"model": "technology security dvr",
"scope": "eq",
"trust": 0.3,
"vendor": "lorex",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00385"
},
{
"db": "BID",
"id": "64783"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001177"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-182"
},
{
"db": "NVD",
"id": "CVE-2014-1201"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:lorex_technology:edge",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:lorex_technology:edge_lh310_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:lorex_technology:edge%2b",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:lorex_technology:edge%2b_lh320_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:lorex_technology:edge2",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:lorex_technology:edge2_lh330_firmware",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:lorex_technology:edge3",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:lorex_technology:edge3_lh340_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001177"
}
]
},
"credits": {
"_id": null,
"data": "Pedro Ribeiro",
"sources": [
{
"db": "BID",
"id": "64783"
},
{
"db": "PACKETSTORM",
"id": "124744"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-182"
}
],
"trust": 1.0
},
"cve": "CVE-2014-1201",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2014-1201",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CNVD-2014-00385",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-69139",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2014-1201",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2014-1201",
"trust": 0.8,
"value": "High"
},
{
"author": "CNVD",
"id": "CNVD-2014-00385",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201401-182",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-69139",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00385"
},
{
"db": "VULHUB",
"id": "VHN-69139"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001177"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-182"
},
{
"db": "NVD",
"id": "CVE-2014-1201"
}
]
},
"description": {
"_id": null,
"data": "Buffer overflow in the INetViewX ActiveX control in the Lorex Edge LH310 and Edge+ LH320 series with firmware 7-35-28-1B26E, Edge2 LH330 series with firmware 11.17.38-33_1D97A, and Edge3 LH340 series with firmware 11.19.85_1FE3A allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in the HTTP_PORT parameter. Lorex Security DVR Edge Series is the Edge series of digital video recorder products from Lorex Technologies of the United States. A remote buffer overflow vulnerability exists in Lorex Security DVR Edge Series. Failed exploit attempts will result in a denial-of-service condition. Hi,\n\nI have discovered a buffer overflow vulnerability that allows remote code\nexecution in an ActiveX control bundled by a manufacturer of video\nsurveillance systems. \nThe company is Lorex Technologies, a major video surveillance manufacturer\nthat is very popular in the US and East Asia. I have confirmed that all\n16 are vulnerable at this point in time. The\nLorex manual[1] instructs the user to blindly accept the ActiveX control\ninstall when prompted. \nThe full list of devices, as well as links to the firware download, can be\nfound in [2]. Their products offer remote video viewing capabilities, and\nyou can find some of them on Shodan[3]. \n\nThe buffer overflow can be triggered by a really long string (10000+\ncharacters) in the HTTP_PORT parameter. The instruction pointer can be very\neasily controlled in XP by the characters 109 to 113 in the string. Please\nrefer to the PoC file lorex-testcase.html. You will see that the HTTP_PORT\nparameter is composed of D\u0027s, apart from chars 109 to 113 which are four\nA\u0027s. If you open this file in IE after installing the control, you will see\nthat IE will crash with an EIP of 0x41414141. Changing the four A\u0027s to any\nother value will cause EIP to crash on that value. \n\nThe list below tells a better story about what is affected and how it can\nbe controlled:\nWin XP SP3 with IE6 - Fully exploitable as described\nWin XP SP3 with IE8 - Could not get it to crash (????)\nWin 7 x64 with IE10 fully patched - Fully exploitable, though not as easy\nas for XP (see analyze -v [4] and !exploitable [5] outputs)\n\nTo verify this vulnerability you can download and extract the firmware\nusing binwalk (http://code.google.com/p/binwalk/). To do so, please follow\nthe instructions in [6], and then install the ActiveX control in\nINetViewProj1_02030330.cab. \n\nI have contacted Lorex and they initially said they would fix it, but went\nradio silent shortly afterwards. \n17.11.2013 - Initial contact via support page\n18.11.2013 - Email to sales, no response. \n21.11.2013 - Second email to sales, received response by sales saying they\nwill forward it to technical support and get back to me. \n04.12.2013 - Third email to sales saying that technical support never\ncontacted me back. No response. \n08.01.2013 - MITRE assigns CVE-2014-1201 to this issue. \n09.01.2013 - Public disclosure. \n\nAll references can be found at:\nhttps://github.com/pedrib/PoC/lorexActivex/lorex-report.txt\n\nProof of concept:\nhttps://github.com/pedrib/PoC/lorexActivex/lorex-testcase.html\n\nRegards,\nPedro Ribeiro (pedrib@gmail.com)\nAgile Information Security\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-1201"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001177"
},
{
"db": "CNVD",
"id": "CNVD-2014-00385"
},
{
"db": "BID",
"id": "64783"
},
{
"db": "VULHUB",
"id": "VHN-69139"
},
{
"db": "PACKETSTORM",
"id": "124744"
}
],
"trust": 2.61
},
"exploit_availability": {
"_id": null,
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-69139",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-69139"
}
]
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2014-1201",
"trust": 3.5
},
{
"db": "OSVDB",
"id": "101903",
"trust": 1.7
},
{
"db": "BID",
"id": "64783",
"trust": 1.6
},
{
"db": "XF",
"id": "90223",
"trust": 1.2
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001177",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201401-182",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2014-00385",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20140110 [CVE -2014-1201] LOREX SECURITY DVR ACTIVEX CONTROL BUFFER OVERFLOW",
"trust": 0.6
},
{
"db": "XF",
"id": "20141201",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "124744",
"trust": 0.2
},
{
"db": "EXPLOIT-DB",
"id": "43891",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-69139",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00385"
},
{
"db": "VULHUB",
"id": "VHN-69139"
},
{
"db": "BID",
"id": "64783"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001177"
},
{
"db": "PACKETSTORM",
"id": "124744"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-182"
},
{
"db": "NVD",
"id": "CVE-2014-1201"
}
]
},
"id": "VAR-201401-0557",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00385"
},
{
"db": "VULHUB",
"id": "VHN-69139"
}
],
"trust": 1.7
},
"iot_taxonomy": {
"_id": null,
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00385"
}
]
},
"last_update_date": "2025-04-11T23:10:34.304000Z",
"patch": {
"_id": null,
"data": [
{
"title": "Security DVR",
"trust": 0.8,
"url": "http://www.lorextechnology.com/product/info/Security-dvrs-digital-video-security-recorders/2000035"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001177"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-69139"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001177"
},
{
"db": "NVD",
"id": "CVE-2014-1201"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 3.1,
"url": "https://github.com/pedrib/poc/blob/master/lorexactivex/lorex-testcase.html"
},
{
"trust": 2.5,
"url": "https://github.com/pedrib/poc/blob/master/lorexactivex/lorex-report.txt"
},
{
"trust": 1.7,
"url": "http://osvdb.org/101903"
},
{
"trust": 1.2,
"url": "http://xforce.iss.net/xforce/xfdb/90223"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/530739/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90223"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-1201"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-1201"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/530739/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/64783"
},
{
"trust": 0.3,
"url": "http://seclists.org/fulldisclosure/2014/jan/41"
},
{
"trust": 0.3,
"url": "http://www.lorextechnology.com/product/info/security-dvrs-digital-video-security-recorders/2000035"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2014-1201"
},
{
"trust": 0.1,
"url": "http://code.google.com/p/binwalk/)."
},
{
"trust": 0.1,
"url": "https://github.com/pedrib/poc/lorexactivex/lorex-testcase.html"
},
{
"trust": 0.1,
"url": "https://github.com/pedrib/poc/lorexactivex/lorex-report.txt"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-00385"
},
{
"db": "VULHUB",
"id": "VHN-69139"
},
{
"db": "BID",
"id": "64783"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001177"
},
{
"db": "PACKETSTORM",
"id": "124744"
},
{
"db": "CNNVD",
"id": "CNNVD-201401-182"
},
{
"db": "NVD",
"id": "CVE-2014-1201"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "CNVD",
"id": "CNVD-2014-00385",
"ident": null
},
{
"db": "VULHUB",
"id": "VHN-69139",
"ident": null
},
{
"db": "BID",
"id": "64783",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2014-001177",
"ident": null
},
{
"db": "PACKETSTORM",
"id": "124744",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201401-182",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2014-1201",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2014-01-17T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-00385",
"ident": null
},
{
"date": "2014-01-15T00:00:00",
"db": "VULHUB",
"id": "VHN-69139",
"ident": null
},
{
"date": "2014-01-09T00:00:00",
"db": "BID",
"id": "64783",
"ident": null
},
{
"date": "2014-01-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001177",
"ident": null
},
{
"date": "2014-01-10T10:22:22",
"db": "PACKETSTORM",
"id": "124744",
"ident": null
},
{
"date": "2014-01-14T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201401-182",
"ident": null
},
{
"date": "2014-01-15T16:08:18.297000",
"db": "NVD",
"id": "CVE-2014-1201",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2014-01-17T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-00385",
"ident": null
},
{
"date": "2018-10-09T00:00:00",
"db": "VULHUB",
"id": "VHN-69139",
"ident": null
},
{
"date": "2014-01-09T00:00:00",
"db": "BID",
"id": "64783",
"ident": null
},
{
"date": "2014-01-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-001177",
"ident": null
},
{
"date": "2014-01-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201401-182",
"ident": null
},
{
"date": "2025-04-11T00:51:21.963000",
"db": "NVD",
"id": "CVE-2014-1201",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201401-182"
}
],
"trust": 0.6
},
"title": {
"_id": null,
"data": "plural Lorex Edge Product firmware INetViewX ActiveX Control buffer overflow vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-001177"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "buffer overflow",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201401-182"
}
],
"trust": 0.6
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…