CVE-2015-0555 Introduction ************************************************************* There is a Buffer Overflow Vulnerability which leads to Remote Code Execution. Vulnerability is due to input validation to the API ReadConfigValue and WriteConfigValue API's in XnsSdkDeviceIpInstaller.ocx This is different from CVE-2014-3911 as the version of iPolis 1.12.2 (latest as of 12/12/2014). CVE-2014-3911 is related to different ActiveX and on older iPolis version Discovery MEthod: Fuzzing Exploiting: It is a client side attack where attacker can host a crafted HTML web page with malicious payload and entice the victim to browse to the hosted page to compromise the victim. Operating System: Windows 7 Ultimate N SP1 ************************************************************* Vulnerability1: *Samsung_iPolis1.12.2_XnsSdkDeviceIpInstaller.ocx_ActiveX_ReadConfigValue_RemoteCodeExecution* ******************Proof of Concept (PoC)**************8 Samsung iPolis 1.12.x XnsSdkDeviceIpInstaller.ocx ReadConfigValue() Remote Code Execution