Security readout for executives and security teams
Plain-English summary
This is a critical memory corruption issue in Amlibweb NetOpacs exposed through IIS. A remote unauthenticated request can trigger unsafe handling of web parameters. Public exploit references exist, but the supplied sources do not show CISA KEV listing or confirmed active exploitation.
Executive priority
Prioritize this as critical for any public-facing library management deployment. The combination of remote unauthenticated access, memory corruption, and public exploit references creates high business risk, especially for legacy systems with unclear patch status.
Technical view
webquery.dll fails to bound input in the app HTTP GET parameter, causing a stack buffer overflow and possible SEH overwrite. The bundle also notes malformed parameter names followed by equals may affect control flow. CVSS v4.0 is 9.3 with network, unauthenticated attack conditions.
Likely exposure
Organizations using legacy Amlibweb Library Management System or NetOpacs on Windows IIS are the likely exposure. Internet-facing IIS deployments are highest risk. Version evidence is broad and incomplete, with affected versions listed as unspecified/all and default status unknown.
Exploitation context
Public Metasploit and Exploit-DB references are cited, so exploit knowledge is public. However, KEV is false and the provided sources do not prove active exploitation in the wild. Treat exposed systems as urgent because attack conditions are remote and unauthenticated.
Researcher notes
The strongest evidence supports the vulnerability class, target component, and public exploit availability. Evidence is weaker for exact affected versions, vendor remediation, and active exploitation. Avoid assuming a patch exists from the supplied sources; confirm directly with Amlib or current maintainer channels.
Mitigation direction
- Check Amlib vendor guidance for supported versions, patches, or retirement advice.
- Remove public internet access to affected NetOpacs or webquery.dll services.
- Disable affected functionality if it is not operationally required.
- Restrict IIS access with VPN, allowlists, or internal-only routing.
- Enable relevant IPS/WAF detections from trusted security vendors.
Validation and detection
- Inventory IIS hosts for Amlibweb, NetOpacs, and webquery.dll exposure.
- Confirm whether any affected service is reachable from the internet.
- Review IIS and security logs for abnormal long query parameters.
- Check IDS/IPS alerts referencing the FortiGuard or Check Point advisories.
- Verify vendor support status and document any compensating controls.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2010-20112 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/amlibweb_webquerydll_app.rbCVE reference · exploit
- https://www.exploit-db.com/exploits/16793CVE reference · exploit
- https://www.fortiguard.com/encyclopedia/ips/24002CVE reference · third-party-advisory
- https://advisories.checkpoint.com/defense/advisories/public/2013/cpai-2013-1344.htmlCVE reference · third-party-advisory
- https://www.amlib.co.uk/product/product.aspx?menuId=top_productsCVE reference · product
- https://www.vulncheck.com/advisories/amlibweb-netopacs-stack-buffer-overflowCVE reference · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.