Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-120 and the CVSS impact.
Summary
Multiple stack-based buffer overflows in WebGate eDVR Manager allow remote attackers to execute arbitrary code via unspecified vectors to the (1) Connect, (2) ConnectEx, or (3) ConnectEx2 function in the WESPEvent.WESPEventCtrl.1 control; (4) AudioOnlySiteChannel function in the WESPPlayback.WESPPlaybackCtrl.1 control; (5) Connect or (6) ConnectEx function in the WESPPTZ.WESPPTZCtrl.1 control; (7) SiteChannel property in the WESPPlayback.WESPPlaybackCtrl.1 control; (8) SiteName property in the WESPPlayback.WESPPlaybackCtrl.1 control; or (9) OpenDVrSSite function in the WESPPTZ.WESPPTZCtrl.1 control.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:webgateinc:edvr_manager:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Webgateinc |
- cpe:2.3:a:webgateinc:edvr_manager:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Webgateinc
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2015-2098
- 2026-10-03 Alias added: GHSA-xwf4-fv46-xv49
References
Advisory 6
- http://www.zerodayinitiative.com/advisories/ZDI-15-058/
- http://www.zerodayinitiative.com/advisories/ZDI-15-060/
- http://www.zerodayinitiative.com/advisories/ZDI-15-061/
- http://www.zerodayinitiative.com/advisories/ZDI-15-064/
- http://www.zerodayinitiative.com/advisories/ZDI-15-065/
- http://www.zerodayinitiative.com/advisories/ZDI-15-066/
More Webgateinc Edvr Manager vulnerabilities
- TI-2015-01882 Use-after-free vulnerability in the Connect function in the WESPMonitor.WESPMonitorCtrl.1… CVSS 2.0MEDIUM 6.8
- TI-2015-01881 Heap-based buffer overflow in the SetConnectInfo function in the WESPPTZ.WESPPTZCtrl.1… CVSS 2.0MEDIUM 6.8
Sources
- CVE-2015-2098 · CVE Program
- CVE-2015-2098 · NVD
- FIRST EPSS
- GHSA-xwf4-fv46-xv49 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences