What is the CVSS score of CVE-2013-6127?

CVE-2013-6127 has a CVSS 2.0 base score of 5.8 (Medium). CVSS vector: AV:N/AC:M/Au:N/C:N/I:P/A:P. EPSS exploitation probability: 4.2%.

Is there a public PoC exploit available for CVE-2013-6127?

Yes, a public proof-of-concept exploit is available for CVE-2013-6127. Prioritise patching immediately. EPSS: 4.2%.

Kingview CVE-2013-6127

MEDIUM

Path Traversal (CWE-22)

2013-10-25 ics-cert@hq.dhs.gov

Path Traversal Kingview

5.8

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.8 MEDIUM

AV:N/AC:M/Au:N/C:N/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:M/Au:N/C:N/I:P/A:P

Attack Vector

Network

Attack Complexity

Confidentiality

None

Integrity

Availability

Lifecycle Timeline

CVE Published

Oct 25, 2013 - 20:55 cve.org

MEDIUM 5.8

DescriptionCVE.org

The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict ReplaceDBFile method calls, which allows remote attackers to create or overwrite arbitrary files, and subsequently execute arbitrary programs, via the two pathname arguments, as demonstrated by a directory traversal attack.

AnalysisAI

The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict ReplaceDBFile method calls, which allows remote. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Path Traversal (CWE-22), which allows attackers to access files and directories outside the intended path. The SUPERGRIDLib.SuperGrid ActiveX control in SuperGrid.ocx before 65.30.30000.10002 in WellinTech KingView before 6.53 does not properly restrict ReplaceDBFile method calls, which allows remote attackers to create or overwrite arbitrary files, and subsequently execute arbitrary programs, via the two pathname arguments, as demonstrated by a directory traversal attack. Affected products include: Wellintech Kingview. Version information: before 65.30.30000.10002.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate and canonicalize file paths. Use chroot or sandboxing. Reject input containing path separators or '../' sequences.