CVE-2017-16724

CVE-2017-16724 affects Advantech WebAccess prior to 8.3, with multiple stack-based buffer overflow flaws. The root cause is failure to validate lengths before copying data into fixed-length stack buffers, enabling writes beyond bounds. Public details across connected sources describe several affe...

CVE-2017-16728

CVE-2017-16728 concerns Advantech WebAccess before 8.3, where an untrusted pointer dereference in the webvrpcs/drawsrv components can cause invalid memory dereference. Public sources describe potential crashes and, in ZDI advisories, remote code execution scenarios without authentication via IOCT...

CVE-2017-16753

CVE-2017-16753 is an improper input validation vulnerability affecting Advantech WebAccess before 8.3. WebAccess may crash due to certain inputs; CVSSv3Base 5.0 (N/A for confidentiality/integrity, Availability High) with network access and low attack complexity. ICS-CERT/NCCIC advisories (ICSA-18...

CVE-2017-16724: Stack-based Buffer Overflow

A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple instances of a vulnerability that allows too much data to be written to a location on the stack...

Advantech WebAccess Input Validation Vulnerability

Advantech WebAccess is a set of HMI/SCADA software from Advantech based on browser architecture. The software supports dynamic graphic display and real-time data control, and provides remote control and management of automation equipment. An input validation vulnerability exists in versions of...

PT-2018-6328

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess versions prior to 8.3 Description: An issue with improper input validation was found, which allows certain inputs that may cause the program to crash. Recommendations: For versions prior to 8.3, update to version 8.3 or...

PT-2018-6315

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess versions prior to 8.3 Description: An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess, which may allow an attacker to cause the program to use an invalid memory address, resulting in a program...

CVE-2017-16728: Untrusted Pointer Dereference

An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple vulnerabilities that may allow an attacker to cause the program to use an invalid memory address, resulting in a program crash...

Advantech WebAccess BWRPswd Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of the command line in the BWRPswd utility. The issue results from the...

Advantech WebAccess picfile File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the picfile parameter in gmicons.asp. The issue results from the lack of proper...

Advantech WebAccess bwwfaa Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of the command line in the bwwfaa utility. The issue results from the...

Advantech WebAccess BwNodeIP Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the parsing of the command line in the BwNodeIP utility. The issue results from th...

Advantech WebAccess webvrpcs drawsrv SQLPutData Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x27ed IOCTL in the webvrpcs process. The issue results...

Advantech WebAccess webvrpcs drawsrv SQLDisconnect Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x27dd IOCTL in the webvrpcs process. The issue results...

Advantech WebAccess webvrpcs drawsrv SQLAllocStmt Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x27e1 IOCTL in the webvrpcs process. The issue results...

Advantech WebAccess webvrpcs drawsrv SQLFreeConnect Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x27db IOCTL in the webvrpcs process. The issue results...

Advantech WebAccess webvrpcs drawsrv SQLFreeStmt Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x27e2 IOCTL in the webvrpcs process. The issue results...

Advantech WebAccess webvrpcs drawsrv SQLSetParam Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x27e9 IOCTL in the webvrpcs process. The issue results...

Advantech WebAccess webvrpcs drawsrv SQLPrepare Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x27e5 IOCTL in the webvrpcs process. The issue results...

Advantech WebAccess webvrpcs drawsrv SQLCancel Untrusted Pointer Dereference Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x27eb IOCTL in the webvrpcs process. The issue results...