Successful exploitation of these vulnerabilities may allow an attacker to gain remote code execution, upload files, delete files, cause a denial-of-service condition, and create an admin account for the application.
The following versions of WebAccess/NMS, a network management system, are affected:
Multiple issues exist that allow files to be uploaded and executed on the system.
CVE-2020-10621 has been assigned to this vulnerability. A CVSS v3 base score of 9.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
There are multiple ways an unauthenticated attacker could perform SQL injection to gain access to sensitive information.
CVE-2020-10617 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection to gain access to sensitive information.
CVE-2020-10623 has been assigned to this vulnerability. A CVSS v3 base score of 6.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).
An attacker could use a specially crafted URL to delete files outside the application’s control.
CVE-2020-10619 has been assigned to this vulnerability. A CVSS v3 base score of 8.2 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H).
An attacker could use a specially crafted URL to delete or read files outside the application’s control.
CVE-2020-10631 has been assigned to this vulnerability. A CVSS v3 base score of 9.1 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H).
The application allows an unauthenticated remote user to create a new admin account.
CVE-2020-10625 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N).
The application does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files.
CVE-2020-10629 has been assigned to this vulnerability. A CVSS v3 base score of 7.5 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
The application does not properly sanitize user input and may allow an attacker to inject system commands remotely.
CVE-2020-10603 has been assigned to this vulnerability. A CVSS v3 base score of 8.8 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
rgod of 9sg working with Trend Micro’s Zero Day Initiative reported these vulnerabilities to CISA.
Advantech recommends updating to Version 3.0.2
CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Specifically, users should:
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on us-cert.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.gov in the Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
No known public exploits specifically target these vulnerabilities.
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10603
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10617
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10619
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10621
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10623
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10625
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10629
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10631
cwe.mitre.org/data/definitions/23.html
cwe.mitre.org/data/definitions/23.html
cwe.mitre.org/data/definitions/306.html
cwe.mitre.org/data/definitions/434.html
cwe.mitre.org/data/definitions/611.html
cwe.mitre.org/data/definitions/78.html
cwe.mitre.org/data/definitions/89.html
cwe.mitre.org/data/definitions/89.html
gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.advantech.com%2Fproducts%2F828e8fed-6112-4965-a485-1b8551fe0b25%2Fwebaccess-nms%2Fmod_a575e526-9b42-4747-b8f0-c13431751a03&data=02%7C01%7Ctyler.thomas%40inl.gov%7C700a1a43391248f5431c08d7d13637f1%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637207903155520284&sdata=BSOHWDixxV1eToxVFpEBFFiamr31TOVYyxF84keaD6Q%3D&reserved=0
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
twitter.com/CISAgov
twitter.com/intent/tweet?text=Advantech%20WebAccess/NMS+https://www.cisa.gov/news-events/ics-advisories/icsa-20-098-01
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-advisories/icsa-20-098-01&title=Advantech%20WebAccess/NMS
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-advisories/icsa-20-098-01
www.oig.dhs.gov/
www.surveymonkey.com/r/CISA-cyber-survey?product=https://www.cisa.gov/news-events/ics-advisories/icsa-20-098-01
www.us-cert.gov/ics
www.us-cert.gov/ics
www.us-cert.gov/ics/alerts/ICS-ALERT-10-301-01
www.us-cert.gov/ics/recommended-practices
www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B
www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=Advantech%20WebAccess/NMS&body=www.cisa.gov/news-events/ics-advisories/icsa-20-098-01