Path traversal

The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a path used in an operation on the filesystem and remotely execute code as an administrator...

CVE-2020-25161

The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a path used in an operation on the filesystem and remotely execute code as an administrator...

CVE-2020-25161

The CVE-2020-25161 issue affects Advantech WebAccess/SCADA, specifically the WADashboard component, in Versions 9.0 and prior. Root cause: External control of a file name or path (CWE-73) allows an attacker to influence filesystem operations and remotely execute code with Administrator privileges...

CVE-2020-25161: External Control of File Name or Path

The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a path used in an operation on the filesystem and remotely execute code as an administrator...

CVE-2019-18243

HMI/SCADA iFIX Versions 6.1 and prior allows a local authenticated user to modify system-wide iFIX configurations through the registry. This may allow privilege escalation...

Privilege escalation

HMI/SCADA iFIX Versions 6.1 and prior allows a local authenticated user to modify system-wide iFIX configurations through the registry. This may allow privilege escalation...

CVE-2019-18255

HMI/SCADA iFIX Versions 6.1 and prior allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow privilege escalation...

CVE-2019-18243

HMI/SCADA iFIX Versions 6.1 and prior allows a local authenticated user to modify system-wide iFIX configurations through the registry. This may allow privilege escalation...

CVE-2019-18243

CVE-2019-18243 affects GE Digital HMI/SCADA iFIX (versions 6.1 and prior). The vulnerability is an Incorrect Permission Assignment for Critical Resource (CWE-732) that allows a local authenticated user to modify system-wide iFIX configurations via the registry (and via section objects), enabling ...

CVE-2019-18255

CVE-2019-18255 concerns HMI/SCADA iFIX (GE Digital) versions 6.1 and prior. A local authenticated user can modify system-wide iFIX configurations through section objects, enabling privilege escalation (I/O/access unspecified beyond local). Multiple connected sources confirm the issue and note it ...

CVE-2019-18255

HMI/SCADA iFIX Versions 6.1 and prior allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow privilege escalation...

Vulnerability Spotlight: Two vulnerabilities in Advantech WebAccess/SCADA

Yuri Kramarz of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered two vulnerabilities in the Advantech WebAccess/SCADA software package. An adversary could exploit each of these vulnerabilities to disclose sensitive information and elevate their...

PT-2021-8999

Name of the Vulnerable Software and Affected Versions HMI/SCADA iFIX versions 6.1 and prior Description The issue allows a local authenticated user to modify system-wide iFIX configurations through section objects, potentially leading to privilege escalation. Recommendations For HMI/SCADA iFIX...

Advantech WebAccess/SCADA Local Elevation of Privilege Vulnerability

Advantech WebAccess/SCADA is a suite of SCADA software from Advantech based on a browser architecture. The software supports dynamic graphical displays and real-time data control, and provides the ability to remotely control and manage automation equipment. A local elevation of privilege...

Advantech WebAccess/SCADA Local Elevation of Privilege Vulnerability (CNVD-2021-11305)

Advantech WebAccess/SCADA is a suite of SCADA software from Advantech based on a browser architecture. The software supports dynamic graphical displays and real-time data control, and provides the ability to remotely control and manage automation equipment. A local elevation of privilege...

Advantech WebAccess/SCADA Local File Inclusion Vulnerability

Advantech WebAccess/SCADA is a suite of SCADA software from Advantech based on a browser architecture. The software supports dynamic graphical displays and real-time data control, and provides the ability to remotely control and manage automation equipment. A local file inclusion vulnerability...

CVE-2019-18255: Incorrect Permission Assignment for Critical Resource

HMI/SCADA iFIX Versions 6.1 and prior allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow privilege escalation...

PT-2021-8998

Name of the Vulnerable Software and Affected Versions HMI/SCADA iFIX versions 6.1 and prior Description The issue allows a local authenticated user to modify system-wide iFIX configurations through the registry, which may lead to privilege escalation. Recommendations For HMI/SCADA iFIX versions 6...

RACOM M!DGE Elevation of Privilege Vulnerability

The RACOM M!DGE is a cellular router designed for SCADA and telemetry mission-critical applications and is ideally suited for many different wireless applications. An elevation of privilege vulnerability exists in RACOM M!DGE firmware version 4.4.40.105. An attacker can exploit this vulnerability...

CVE-2019-18243: Incorrect Permission Assignment for Critical Resource

HMI/SCADA iFIX Versions 6.1 and prior allows a local authenticated user to modify system-wide iFIX configurations through the registry. This may allow privilege escalation...