Multiple vulnerabilities in Advantech WebAccess/SCADA



| Updated: 2019-07-04
Risk High
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2019-6550
CVE-2019-6552
CVE-2019-6554
CWE-ID CWE-121
CWE-78
CWE-284
Exploitation vector Network
Public exploit N/A
Vulnerable software
 WebAccess/SCADA
Server applications / SCADA systems

Vendor Advantech Co., Ltd

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Stack-based buffer overflow

EUVDB-ID: #VU19006

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-6550

CWE-ID: CWE-121 - Stack-based buffer overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing data passed to the webvrpcs process, within makensis.exe accessible through the 0x2711 IOCTL. A remote unauthenticated attacker can send a specially crafted request to the application, trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of these vulnerabilities may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

WebAccess/SCADA: 7.2 - 8.3.5

CPE2.3 External links

https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01
https://www.zerodayinitiative.com/advisories/ZDI-19-585/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) OS Command Injection

EUVDB-ID: #VU19007

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2019-6552

CWE-ID: CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to insufficient validation of user-supplied data. A remote unauthenticated attacker can send a specially crafted request to the application and execute arbitrary OS commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

WebAccess/SCADA: 7.2 - 8.3.5

CPE2.3 External links

https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper access control

EUVDB-ID: #VU19008

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-6554

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain unauthorized access to sensitive information.

The vulnerability exists due to improper access restrictions. A remote attacker can send a specially crafted request to the affected application and perform a denial of service attack.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

WebAccess/SCADA: 7.2 - 8.3.5

CPE2.3 External links

https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###