PT-2018-1162 · Advantech · Advantech Webaccess

Nassim Asrir · Publicado 2018-02-13 · Atualizado 2019-08-02 · CVE-2018-6911

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Advantech WebAccess version 8.3.0

Description The issue is related to the VBWinExec function in NodeAspVBObj.dll, which allows remote attackers to execute arbitrary OS commands via a single argument, specifically the command parameter. This is due to the lack of measures to neutralize special elements used in OS commands. Exploitation of this issue can allow a remote attacker to execute arbitrary OS commands using a specially crafted parameter.

Recommendations For Advantech WebAccess version 8.3.0, consider disabling the VBWinExec function as a temporary workaround until a patch is available. Restrict access to the NodeAspVBObj.dll module to minimize the risk of exploitation. Avoid using the command parameter in the affected function until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2018-00609

CVE-2018-6911

Produtos afetados

Advantech Webaccess

Referências · 4

• 🔥 https://exploit-db.com/exploits/44031 · Exploit
• https://bdu.fstec.ru/vul/2018-00609 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-6911 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-6911 · Aviso do Fabricante