PT-2018-3101 · Advantech · Advantech Webaccess

Publicado 2018-10-23 · Atualizado 2019-10-09 · CVE-2018-14820

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 8.3.1 and earlier

Description The issue arises from insufficient input validation in a .dll component of the Advantech WebAccess software, allowing a remote attacker to delete arbitrary files. This can occur when the component is exploited, enabling the attacker to control file names or paths, which may result in the deletion of files.

Recommendations For Advantech WebAccess versions 8.3.1 and earlier, consider restricting access to the vulnerable .dll component until a patch is available. As a temporary workaround, limit the ability of the software to delete files based on external input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-73

CWE-20

Identificadores relacionados

BDU:2019-04032

CVE-2018-14820

ZDI-18-1299

Produtos afetados

Advantech Webaccess

Referências · 9

• https://bdu.fstec.ru/vul/2019-04032 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-18-1299 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-14820 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSA-18-296-01%2C · Nota
• https://cxsecurity.com/cveshow/CVE-2018-14820 · Nota
• http://securitytracker.com/id/1041939 · Nota
• https://osv.dev/vulnerability/CVE-2018-14820 · Aviso do Fabricante
• https://securityfocus.com/bid/105728 · Nota
• http://securityfocus.com/bid/105728 · Nota