Lucene search

[email protected]CVE-2023-32628

HistoryJun 06, 2023 - 12:15 a.m.

CVE-2023-32628

2023-06-0600:15:10

CWE-434

[email protected]

web.nvd.nist.gov

advantech

webaccss

scada

arbitrary file upload

vulnerability

remote code execution

cve-2023-32628

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

53.0%

JSON

In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of a certificate file to ASP when uploading it, which can lead to remote code execution.

CPENameOperatorVersion
advantech:webaccess\/scadaadvantech webaccess\/scadale9.1.3
advantech:webaccess\/scadaadvantech webaccess\/scadaeq8.2_20170817
advantech:webaccess\/scadaadvantech webaccess\/scadaeq8.3.2
advantech:webaccess\/scadaadvantech webaccess\/scadaeq8.0
advantech:webaccess\/scadaadvantech webaccess\/scadaeq7.2
advantech:webaccess\/scadaadvantech webaccess\/scadaeq9.0.1
advantech:webaccess\/scadaadvantech webaccess\/scadaeq8.2
advantech:webaccess\/scadaadvantech webaccess\/scadaeq-
advantech:webaccess\/scadaadvantech webaccess\/scadaeq8.1
advantech:webaccess\/scadaadvantech webaccess\/scadaeq8.4.5

CPE	Name	Operator	Version
advantech:webaccess\/scada	advantech webaccess\/scada	le	9.1.3
advantech:webaccess\/scada	advantech webaccess\/scada	eq	8.2_20170817
advantech:webaccess\/scada	advantech webaccess\/scada	eq	8.3.2
advantech:webaccess\/scada	advantech webaccess\/scada	eq	8.0
advantech:webaccess\/scada	advantech webaccess\/scada	eq	7.2
advantech:webaccess\/scada	advantech webaccess\/scada	eq	9.0.1
advantech:webaccess\/scada	advantech webaccess\/scada	eq	8.2
advantech:webaccess\/scada	advantech webaccess\/scada	eq	-
advantech:webaccess\/scada	advantech webaccess\/scada	eq	8.1
advantech:webaccess\/scada	advantech webaccess\/scada	eq	8.4.5

Rows per page:

1-10 of 121

References

www.cisa.gov/news-events/ics-advisories/icsa-23-152-01

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.002 Low

EPSS

Percentile

53.0%

JSON

Related for CVE-2023-32628

prion1 cvelist1 ics1