CVE-2021-22669

Incorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA portal of WebAccess/SCADA Versions 9.0.1 and prior, which may allow a low-privileged user to update an administrator’s password and login as an administrator to escalate privileges on the system...

Default credentials

Incorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA portal of WebAccess/SCADA Versions 9.0.1 and prior, which may allow a low-privileged user to update an administrator’s password and login as an administrator to escalate privileges on the system...

CVE-2021-22669

CVE-2021-22669 affects Advantech WebAccess/SCADA versions 9.0.1 and earlier. Incorrect default permissions on the Project Management page may allow a low-privileged user to update an administrator’s password and log in as an administrator, enabling privilege escalation. Vendor guidance: update to...

CVE-2021-22669

Incorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA portal of WebAccess/SCADA Versions 9.0.1 and prior, which may allow a low-privileged user to update an administrator’s password and login as an administrator to escalate privileges on the system...

Beers with Talos Ep. #103: ICS/SCADA Security — The permanence and people problems

Beers with Talos BWT Podcast episode No. 103 is now available. Download this episode and subscribe to Beers with Talos:Apple Podcasts Google PodcastsSpotify StitcherIf iTunes and Google Play aren't your thing, click here. By Mitch Neff. Recorded March 2021 ICS and SCADA... This is only the...

PT-2021-6930 · Elcomplus · Elcomplus Smartptt

Name of the Vulnerable Software and Affected Versions: Elcomplus SmartPTT affected versions not specified Description: The issue is related to authorization errors in the Elcomplus SmartPTT scada-server, allowing a low-authenticated user to access higher-level administration authorization. This c...

Advantech WebAccess/SCADA Critical Resource Permission Assignment Incorrect Vulnerability

Advantech WebAccess/SCADA is a suite of SCADA software from Advantech based on a browser architecture. The software supports dynamic graphical displays and real-time data control, and provides the ability to remotely control and manage automation equipment. A vulnerability exists in the Project...

Advantech WebAccess SCADA 安全漏洞

Advantech WebAccess/SCADA is a suite of SCADA software from Advantech based on a browser architecture. The software supports dynamic graphical displays and real-time data control, and provides the ability to remotely control and manage automation equipment. A vulnerability exists in the Project...

The vulnerability of the client-server data processing and technical operations control application Proficy HMI/SCADA CIMPLICITY, due to lack of access control mechanisms, allows attackers to execute arbitrary code or escalate their privileges.

The vulnerability of the client-server data processing and technical operations control application Proficy HMI/SCADA CIMPLICITY is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to execute arbitrary code or enhance their privileges...

Advantech WebAccessSCADA

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Advantech Equipment: WebAccess/SCADA Vulnerability: Incorrect Permission Assignment for Critical Resource 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to...

The vulnerability of the interactive graphical SCADA system, Interactive Graphical SCADA System (IGSS), arises from operations that go beyond the buffer boundaries in memory, allowing attackers to read or write arbitrary files.

The vulnerability of the interactive graphical SCADA system, Interactive Graphical SCADA System IGSS, arises from the operation of a command that goes beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker who operates remotely to read or write arbitrary files...

CISA Warns of Security Flaws in GE Power Management Devices

The U.S. Cybersecurity & Infrastructure Security Agency CISA is warning of critical-severity security flaws in GE’s Universal Relay UR family of power management devices. GE’s UR devices are the “basis of simplified power management for the protection of critical assets,” according to the company...

SQL Injection Vulnerability in Tianxin SCADA System of Tianxin Instrumentation Group Limited (CNVD-2021-24452)

TIANXIN Instrumentation Group Limited is a professional service provider of flow meters and gas application system solutions in China. A SQL injection vulnerability exists in the TIANXIN SCADA system of TIANXIN Instrumentation Group Limited. An attacker can exploit the vulnerability to obtain...

SQL Injection Vulnerability in Tianxin SCADA System of Tianxin Instrumentation Group Limited (CNVD-2021-24453)

TIANXIN Instrumentation Group Limited is a professional service provider of flow meters and gas application system solutions in China. A SQL injection vulnerability exists in the TIANXIN SCADA system of TIANXIN Instrumentation Group Limited. An attacker can exploit the vulnerability to obtain...

SQL Injection Vulnerability in Tianxin SCADA System of Tianxin Instrumentation Group Limited (CNVD-2021-24454)

TIANXIN Instrumentation Group Limited is a professional service provider of flow meters and gas application system solutions in China. A SQL injection vulnerability exists in the TIANXIN SCADA system of TIANXIN Instrumentation Group Limited. An attacker can exploit the vulnerability to obtain...

CVE-2021-27436

WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting user, which could result in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage and performing...

CVE-2021-27436

WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting user, which could result in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage and performing...

Cross site scripting

WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting user, which could result in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage and performing...

CVE-2021-27436

WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting user, which could result in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage and performing...

CVE-2021-27436

CVE-2021-27436 affects Advantech WebAccess/SCADA versions 9.0 and earlier. The vulnerability is a cross-site scripting (CWE-79) in web-page generation, allowing an attacker to deliver malicious JavaScript to a logged-in user, potentially hijacking cookies/sessions, redirecting to malicious pages,...