Advantech WebAccess ActiveX Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-173-01 Advantech WebAccess ActiveX Vulnerabilities that was published June 21, 2016, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 2 -------- Zhou Yu of Acorn Network Security and ZDI Zero...

Advantech WebAccess SCADA Dashboard Arbitrary File Upload (CVE-2016-0854)

An arbitrary file upload vulnerability has been reported in the Dashboard component of Advantech WebAccess. The vulnerability is due to insufficient input validation within the uploadImageCommon, uploadFile or uploadBannerImage methods in the UploadAjaxAction script. A remote, unauthenticated...

Advantech WebAccess SCADA Dashboard Directory Traversal (CVE-2016-0855)

A directory traversal vulnerability has been reported in the Dashboard component of Advantech WebAccess. The vulnerability is due to insufficient input validation within the openWidget, removeFolder or removeFile methods in the FileAjaxAction script. A remote, unauthenticated attacker could explo...

Advantech Webaccess Dashboard Viewer - Arbitrary File Upload (Metasploit)

Exploit for windows platform in category remote exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Advantech WebAccess Dashboard Viewer Arbitrary File Upload",...

Advantech Webaccess Dashboard Viewer - Arbitrary File Upload (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Advantech WebAccess Dashboard Viewer Arbitrary File Upload", 'Description' = %q This module exploits an arbitrary file upload...

Advantech WebAccess multiple services Buffer Overflow (CVE-2016-0856)

A buffer overflow vulnerability has been reported in the webvrpcs and datacore service of Advantech WebAccess. The vulnerability is due to an insecure call to some functions. A remote, unauthenticated attacker could exploit this vulnerability by sending a maliciously crafted request to the target...

Advantech WebAccess 8.0 Dashboard Viewer Arbitrary File Upload

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule "Advantech WebAccess Dashboard Viewer Arbitrary File Upload", 'Description' = %q This module exploits an arbitrary file upload...

Advantech WebAccess ActiveX Vulnerabilities (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-173-01 Advantech WebAccess ActiveX Vulnerabilities that was published June 21, 2016, on the NCCIC/ICS-CERT web site. --------- Begin Update A Part 1 of 2 -------- Zhou Yu of Acorn Network Security and ZDI Zero...

Advantech WebAccess < 8.1-2015.12.30 Multiple Vulnerabilities

Binary data scadaadvantechwebaccess8120151230.nbin...

Advantech/B+B SmartWorx VESP211-EU and VESP211-232 Arbitrary Command Execution Vulnerability

The Advantech/B+B SmartWorx VESP211-EU and VESP211-232 are both Advantech China interfaces for connecting serial devices to Ethernet. An arbitrary command execution vulnerability exists in the Advantech/B+B SmartWorx VESP211-EU and VESP211-232, which could allow a remote attacker to perform...

CVE-2016-2275

The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access control, which allows remote attackers to perform administrative actions via modified JavaScript code...

CVE-2016-2275

The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access control, which allows remote attackers to perform administrative actions via modified JavaScript code...

Improper access control

The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access control, which allows remote attackers to perform administrative actions via modified JavaScript code...

CVE-2016-2275

The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access control, which allows remote attackers to perform administrative actions via modified JavaScript code...

CVE-2016-2275

CVE-2016-2275 affects Advantech/B+B SmartWorx VESP211-EU (firmware 1.7.2) and VESP211-232 (firmware 1.5.1 and 1.7.2). The web interface relies on client-side authentication, permitting remote attackers to perform administrative actions by modifying JavaScript. Exposure is via network-accessible w...

CVE-2016-2275: Improper Access Control

The web interface on Advantech/B+B SmartWorx VESP211-EU devices with firmware 1.7.2 and VESP211-232 devices with firmware 1.5.1 and 1.7.2 relies on the client to implement access control, which allows remote attackers to perform administrative actions via modified JavaScript code...

Advantech WebAccess openWidget Script Path Traversal Remote File Disclosure

Binary data scadaadvantechwebaccesscve-2016-0855.nbin...

The software of the Advantech WebAccess remote monitoring system is vulnerable, allowing a intruder to modify files of any type.

The vulnerability of Advantech WebAccess remote monitoring software lies in the lack of restrictions on file downloads. Exploiting this vulnerability allows a malicious actor to modify files of any type remotely...

The vulnerabilities of the Advantech WebAccess remote monitoring software allow a intruder to execute arbitrary code.

The multiple vulnerabilities of the Advantech WebAccess remote monitoring software are caused by a buffer overflow in the dynamic memory. Exploiting these vulnerabilities allows a malicious actor operating remotely to execute arbitrary code...

The vulnerabilities of the Advantech WebAccess remote monitoring software allow a intruder to execute arbitrary code.

The multiple vulnerabilities of the Advantech WebAccess remote monitoring software are caused by buffer overflow on the stack. Exploitation of these vulnerabilities could allow a malicious actor operating remotely to execute arbitrary code...