Advantech WebAccess HEAP Buffer Overflow Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. Advantech WebAccess suffers from a HEAP buffer overflow...

Advantech WebAccess Unauthorized Operation Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. An unauthorized operation vulnerability exists in Advantec...

Advantech WebAccess Elevation of Privilege Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. An elevation of privilege vulnerability exists in Advantec...

PT-2017-12656

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817 Description An issue was discovered where string format specifiers based on user-provided input are not properly validated, which could allow an attacker to execute arbitrary code. This is...

Advantech WebAccess Arbitrary Code Execution Vulnerability (CNVD-2017-23882)

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. An arbitrary code execution vulnerability exists in...

Advantech WebAccess Arbitrary Code Execution Vulnerability (CNVD-2017-23878)

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. An arbitrary code execution vulnerability exists in...

CVE-2017-12717: Uncontrolled Search Path Element

An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.220170817. A maliciously crafted dll file placed earlier in the search path may allow an attacker to execute code within the context of the application...

PT-2017-12665

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817 Description An issue with incorrect permission assignment for critical resources was found, allowing non-administrator accounts to modify multiple files and folders with ACLs that affect othe...

PT-2017-12658

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817 Description A heap-based buffer overflow issue was discovered due to a lack of proper validation of the length of user-supplied data prior to copying it to the heap-based buffer. This could...

PT-2017-12664

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817 Description An issue with incorrect privilege assignment was found, where a built-in user account was granted a sensitive privilege. This could potentially allow a user to elevate their...

PT-2017-12663

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817 Description A SQL Injection issue was discovered, allowing an attacker to inject arbitrary SQL statements by submitting a specially crafted parameter. This could enable the attacker to obtain...

PT-2017-12666

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817 Description An issue was discovered that allows an attacker to execute code within the context of the application by using a maliciously crafted dll file placed earlier in the search path...

CVE-2017-12711: Incorrect Privilege Assignment

An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.220170817. A built-in user account has been granted a sensitive privilege that may allow a user to elevate to administrative privileges...

CVE-2017-12710: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.220170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to obtain sensitive information...

CVE-2017-12706: Stack-based Buffer Overflow

A stack-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.220170817. Researchers have identified multiple vulnerabilities where there is a lack of proper validation of the length of user-supplied data prior to copying it to a stack-based buffer, which could...

CVE-2017-12702: Use of Externally-Controlled Format String

An Externally Controlled Format String issue was discovered in Advantech WebAccess versions prior to V8.220170817. String format specifiers based on user provided input are not properly validated, which could allow an attacker to execute arbitrary code...

CVE-2017-12708: Improper Restriction of Operations within the Bounds of a Memory Buffer

An Improper Restriction Of Operations Within The Bounds Of A Memory Buffer issue was discovered in Advantech WebAccess versions prior to V8.220170817. Researchers have identified multiple vulnerabilities that allow invalid locations to be referenced for the memory buffer, which may allow an...

CVE-2017-12698: Improper Authentication

An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.220170817. Specially crafted requests allow a possible authentication bypass that could allow remote code execution...

Advantech WebAccess Product Installation File Access Control Modification Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privilege on vulnerable installations of Advantech WebAccess. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the access...

Advantech WebAccess Authentication Bypass Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. An authentication bypass vulnerability exists in Advantech...