PT-2016-2293 · Advantech · Advantech Webaccess

Zhou Yu · Publicado 2016-06-25 · Atualizado 2016-06-28 · CVE-2016-4525

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Média

Vetor base

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1 20160519

Description The issue is related to unspecified ActiveX controls and errors in the code of the Advantech WebAccess software. It may allow a remote authenticated user to obtain sensitive information or modify data. The exploitation is connected to the INTERFACESAFE FOR UNTRUSTED CALLER flag, which is related to safety for scripting.

Recommendations For Advantech WebAccess versions prior to 8.1 20160519, update to version 8.1 20160519 or later to resolve the issue. As a temporary workaround, consider restricting access to the ActiveX controls until a patch is applied.

Correção

Enumeração de Fraquezas

CWE-17

Identificadores relacionados

BDU:2016-01682

CVE-2016-4525

Produtos afetados

Advantech Webaccess

Referências · 4

• https://ics-cert.us-cert.gov/advisories/ICSA-16-173-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4525 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-4525 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-01682 · Nota de Segurança