CVE-2016-0856

CVE-2016-0856 affects Advantech WebAccess (pre-8.1). The root cause is a stack-based buffer overflow in the bwconn.dll RpcWebClientConnect path (IoRequest structure) that can be triggered remotely to execute arbitrary code. Public PoCs and PoC-style repositories on Gitee describe a Python/ctypes-...

CVE-2016-0857

CVE-2016-0857 maps to multiple heap-based buffer overflow issues in Advantech WebAccess prior to 8.1. Technical details in connected advisories specify vulnerable components and paths, including a heap-overflow in the BwpAlarm subsystem (BwpAlarm.dll) via a strcpy-based overflow, and related heap...

CVE-2016-0855

CVE-2016-0855 concerns Advantech WebAccess (pre-8.1). The vulnerability is a directory traversal in the WebAccess Dashboard/Viewer that could allow remote attackers to list arbitrary files in a virtual directory via unspecified vectors. Public references from ZDI describe related dashboard viewer...

CVE-2016-0860

CVE-2016-0860 describes a buffer overflow in the BwpAlarm subsystem of Advantech WebAccess prior to 8.1, allowing remote attackers to cause a denial of service via a crafted RPC request. Public docs confirm the affected product (Advantech WebAccess), version before 8.1, and remote-execution/DoS r...

CVE-2015-3948

Summary : CVE-2015-3948 is a cross-site scripting (XSS) vulnerability in Advantech WebAccess prior to 8.1. The issue allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors. According to NVD, the CVSS base score (v3) is 5.4 (Medium) with network access, lo...

CVE-2015-3947

Advantech WebAccess (before 8.1) is affected by a SQL Injection vulnerability (CWE-89) that allows remote authenticated users to execute arbitrary SQL commands, potentially modifying web server settings, accounts, and projects. Root cause details are described in PT-2016-03: SQL Injection in WebA...

CVE-2016-0854

Affected product: Advantech WebAccess, specifically the Dashboard Viewer component of WebAccess prior to version 8.1. Vulnerability summary: Unrestricted upload of a file with dangerous type via the UploadAjaxAction script (uploadImageCommon/uploadFile/uploadBannerImage paths) in the WebAccess Da...

CVE-2015-3943

Advantech WebAccess CVE-2015-3943: An information-disclosure vulnerability in WebAccess versions before 8.1 allows remote attackers to read cleartext data from e-mail project accounts. Connected sources (ICS-CERT advisory ICSA-16-014-01, CNVD entries, NVD record) confirm the root cause involves i...

CVE-2015-3946

CVE-2015-3946 (Advantech WebAccess) : A CSRF vulnerability exists in WebAccess prior to version 8.1 that can allow remote attackers to hijack user authentication. Affected product: Advantech WebAccess (HMI/SCADA software). Root cause: cross-site request forgery enabling unauthorized actions in au...

CVE-2015-6467

CVE-2015-6467 affects Advantech WebAccess (HMI/SCADA) prior to version 8.1. The vulnerability is a remote code execution via a browser plugin, allowing an attacker to run arbitrary code on the target. Connected sources confirm a remote-exploit scenario and that Advantech released WebAccess 8.1 to...

CVE-2016-0858

CVE-2016-0858 affects Advantech WebAccess prior to 8.1. A race condition in the WebAccess components can be triggered by a crafted request, enabling remote attackers to execute arbitrary code or cause a denial of service via a buffer overflow. Public sources identify this as a remote-exploit scen...

CVE-2016-0859

Summary: CVE-2016-0859 affects Advantech WebAccess before 8.1. The vulnerability is an integer overflow in the Kernel service that can be triggered by a crafted RPC request, leading to remote code execution or a denial of service (stack-based buffer overflow). Affected product/version: WebAccess ...

CVE-2016-0851

CVE-2016-0851 affects Advantech WebAccess prior to 8.1. The issue arises from a memory safety flaw (out-of-bounds access) that can be triggered remotely, leading to a denial of service. ZDI documents a separate vulnerable path in the BwOpcSvc.dll 0x13881 IOCTL implementation, described as an unco...

CVE-2016-4528

CVE-2016-4528 is a classic buffer overflow in Advantech WebAccess (pre-8.1_20160519). A specially crafted DLL file can trigger the overflow when the vulnerable WebAccess runs, with local user interaction; ICS-CERT notes it could allow code to be inserted and run, while other sources describe pote...

CVE-2016-0853

Advantech WebAccess (HMI/SCADA) before version 8.1 is affected by CVE-2016-0853, enabling remote attackers to obtain sensitive information via crafted input. The advisory notes the issue is tied to input handling and results in information disclosure. Advantech released WebAccess 8.1 to address v...

CVE-2016-4525

Summary: CVE-2016-4525, CVE-2016-4528 and CVE-2016-5810 affect Advantech WebAccess prior to version 8.1_20160519. The issues arise from unsafe ActiveX controls marked as safe-for-scripting (CVE-2016-4525), a buffer overflow via crafted DLLs (CVE-2016-4528), and information exposure where an authe...

CVE-2016-0852

CVE-2016-0852 affects Advantech WebAccess (pre-8.1). The vulnerability, described in ICS-CERT and CVE records, allows remote attackers to bypass an administrative requirement and gain access to files/folders via unspecified vectors. Affected versions include WebAccess 8.0 and earlier. Impact desc...