CVE-2014-9188

Buffer overflow in an ActiveX control in MDraw30.ocx in Schneider Electric ProClima before 6.1.7 allows remote attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2014-8513 and CVE-2014-8514. NOTE: this may be clarified later based on details provided by researchers.

• CWE-77
• CWE-119

• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-344-01Patch, Vendor Advisory
• https://www.cisa.gov/news-events/ics-advisories/icsa-14-350-01
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD%202014-344-01Patch, Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-14-350-01Patch, Third Party Advisory, US Government Resource

Published

Dec 27, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-9182models/comment.php in Anchor CMS 0.9.2 and earlier allows re…
• CVE-2014-9183ZTE ZXDSL 831CII has a default password of admin for the adm…
• CVE-2014-9184ZTE ZXDSL 831CII allows remote attackers to bypass authentic…
• CVE-2014-9185Static code injection vulnerability in install.php in Morfy …
• CVE-2014-9186A file inclusion vulnerability exists in the confd.exe modul…
• CVE-2014-9187Multiple heap-based buffer overflow vulnerabilities exist in…
• CVE-2014-9189Multiple stack-based buffer overflow vulnerabilities were fo…
• CVE-2014-9190Stack-based buffer overflow in Schneider Electric Wonderware…
• CVE-2014-9191The CodeWrights HART Device Type Manager (DTM) library in Em…
• CVE-2014-9192Integer overflow in Trihedral Engineering VTScada (formerly …
• CVE-2014-9193Innominate mGuard with firmware before 7.6.6 and 8.x before …
• CVE-2014-9194Arbiter 1094B GPS Substation Clock allows remote attackers t…