Advantech WebAccess webvrpcs.exe Path Traversal RCE

The Advantech WebAccess/SCADA Network Service (webvrpcs.exe) running on the remote host is affected by a path traversal vulnerability due to the failure to properly validate user-supplied input when processing a DCERPC request. An unauthenticated, remote attacker can exploit this, via a series of crafted requests, to execute arbitrary code.

Note that this vulnerability is supposedly fixed in WebAccess/SCADA version 8.3, but it appears that versions 8.3.1 and 8.3.2 are still vulnerable.