Multiple vulnerabilities in Advantech WebAccess

Published: 2018-05-16 12:43:00
Severity High
Patch available YES
Number of vulnerabilities 13
CVE ID CVE-2016-4528
CVE-2016-4525
CVE-2018-7501
CVE-2018-10590
CVE-2018-7505
CVE-2018-7503
CVE-2018-10589
CVE-2018-7499
CVE-2018-8845
CVE-2018-7497
CVE-2018-7495
CVE-2018-10591
CVE-2018-8841
CVSSv3 5.2 [AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H/E:U/RL:O/RC:C]
5.8 [AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]
6.4 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
6.5 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
8.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
4.6 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
8.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
8.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
8.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
8.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
4.6 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
4.6 [CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
3.8 [CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CWE ID CWE-89
CWE-200
CWE-285
CWE-22
CWE-121
CWE-122
CWE-822
CWE-73
CWE-346
CWE-269
Exploitation vector Network
Public exploit Not available
Vulnerable software Advantech WebAccess
WebAccess Dashboard
WebAccess Scada Node
WebAccess/NMS
Vulnerable software versions Advantech WebAccess 8.1_20160519
Advantech WebAccess 8.2_20170817
Advantech WebAccess 8.3
WebAccess Dashboard 2.0.15
WebAccess Scada Node 8.3.0
WebAccess/NMS 2.0.3
Vendor URL Advantech Co., Ltd

Security Advisory

1) Classic buffer overflow in Advantech WebAccess

Description

The vulnerability allows a local user to insert and run arbitrary code on an affected system.

The vulnerability exists due to boundary error.  A local user can cause a buffer overflow by sending a specially crafted a specially crafted DLL file to vulnerable server.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Advantech has released a new version of WebAccess, Version 8.1_20160519, to address the reported vulnerabilities.
This new version is available on:
http://www.advantech.com/industrial-automation/webaccess

External links

https://ics-cert.us-cert.gov/advisories/ICSA-16-173-01

2) Unsafe Activex Control Marked Safe-for-Scripting

Description

The vulnerability allow a local user to to insert and run arbitrary code on an affected system.

This vulnerability ts not exploitable remotely and cannot be exploited without user interaction.

Successful exploitation of this vulnerability may lead to several ActiveX controls, which are intended for restricted use, can be marked as safe-for-scripting.

Remediation

Advantech has released a new version of WebAccess, Version 8.1_20160519, to address the reported vulnerabilities.
This new version is available on:
http://www.advantech.com/industrial-automation/webaccess

External links

https://ics-cert.us-cert.gov/advisories/ICSA-16-173-01

3) SQL injection

Description

The vulnerability allows a remote attacker to execute arbitrary SQL commands in web application database.

The weakness exists due to insufficient sanitization of user-supplied data. A remote attacker can send a specially crafted HTTP request to vulnerable script and execute arbitrary SQL commands in web application database.

Successful exploitation of the vulnerability may allow an attacker to gain administrative access to vulnerable web application.

Remediation

Update WebAccess Scada Note to version 8.3.1.

External links

https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01

4) Information disclosure

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to improper directory listing control. A remote attacker can find important files that are not normally visible.

Remediation

Update WebAccess Scada Note to version 8.3.1.

External links

https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01

5) Improper authorization

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in a TFTP application due to unrestricted file uploads to the web application without authorization. A remote attacker can bypass authorization and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Remediation

Update WebAccess Scada Note to version 8.3.1.

External links

https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01

6) Path traversal

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to path traversal. A remote attacker can gain access to potentially sensitive information.

Remediation

Update WebAccess Scada Note to version 8.3.1.

External links

https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01

7) Path traversal

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to path traversal. A remote attacker can execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Remediation

Update WebAccess Scada Note to version 8.3.1.

External links

https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01

8) Stack-based buffer overflow

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to stack-based buffer overflow. A remote attacker can trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Remediation

Update WebAccess Scada Note to version 8.3.1.

External links

https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01

9) Heap-based buffer overflow

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to heap-based buffer overflow. A remote attacker can trigger memory corruption and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Remediation

Update WebAccess Scada Note to version 8.3.1.

External links

https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01

10) Untrusted pointer dereference

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to untrusted pointer dereference. A remote attacker can execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Remediation

Update WebAccess Scada Note to version 8.3.1.

External links

https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01

11) External control of file name or path

Description

The vulnerability allows a remote attacker to write arbitrary files on the target system.

The weakness exists due to external control of file name or path. A remote attacker can delete arbitrary files.

Remediation

Update WebAccess Scada Note to version 8.3.1.

External links

https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01

12) Origin validation error

Description

The vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to origin validation error. A remote attacker can create a malicious web site, steal session cookies and access data of authenticated users.

Remediation

Update WebAccess Scada Note to version 8.3.1.

External links

https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01

13) Improper privilege management

Description

The vulnerability allows a remote authenticated attacker to write arbitrary files on the target system.

The weakness exists due to improper privilege management. A remote attacker can modify files when read access should only be given to the user.

Remediation

Update WebAccess Scada Note to version 8.3.1.

External links

https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01

Back to List