PT-2018-1177 · Advantech · Advantech Webaccess Hmi Designer

Steven Seeley · Publicado 2018-04-24 · Atualizado 2019-10-09 · CVE-2018-8837

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech WebAccess HMI Designer version 2.1.7.32 and prior

Description The issue is caused by writing data outside the intended buffer area in memory when processing specially crafted .pm3 files. This may allow remote code execution. The vulnerability can be exploited by an attacker using specially crafted .pm3 files to execute arbitrary code.

Recommendations For Advantech WebAccess HMI Designer version 2.1.7.32 and prior, consider avoiding the use of .pm3 files from untrusted sources until a patch is available. As a temporary workaround, restrict access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Memory Corruption

Enumeração de Fraquezas

CWE-787

Identificadores relacionados

BDU:2018-00632

CVE-2018-8837

Produtos afetados

Advantech Webaccess Hmi Designer

Referências · 8

• https://osv.dev/vulnerability/CVE-2018-8837 · Aviso do Fabricante
• https://threatpost.ru/three-vulnerabilities-found-in-advantech-webaccess-hmi-designer/25835 · Nota
• https://ics-cert.us-cert.gov/advisories/ICSA-18-114-03 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-8837 · Nota de Segurança
• http://securityfocus.com/bid/103972 · Nota
• https://cybersecurity-help.cz/vdb/SB2018042517?affChecked=1 · Nota
• https://bdu.fstec.ru/vul/2018-00632 · Nota de Segurança
• https://securitylab.ru/vulnerability/492920.php · Nota