Lucene search

IcscertCVELIST:CVE-2024-2453

HistoryMar 21, 2024 - 10:39 p.m.

CVE-2024-2453 Advantech WebAccess/SCADA SQL Injection

2024-03-2122:39:15

CWE-89

icscert

www.cve.org

cve-2024-2453

sql injection

advantech webaccess/scada

remote data manipulation

6.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.8%

JSON

There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "WebAccess/SCADA",
    "vendor": "Advantech",
    "versions": [
      {
        "status": "affected",
        "version": "9.1.5U"
      }
    ]
  }
]

References

www.cisa.gov/news-events/ics-advisories/icsa-24-081-01

6.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

6.8 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

8.8%

JSON

Related for CVELIST:CVE-2024-2453