PT-2016-2293 · Advantech · Advantech Webaccess

Zhou Yu · Published 2016-06-25 · Updated 2016-06-28 · CVE-2016-4525

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1 20160519

Description The issue is related to unspecified ActiveX controls and errors in the code of the Advantech WebAccess software. It may allow a remote authenticated user to obtain sensitive information or modify data. The exploitation is connected to the INTERFACESAFE FOR UNTRUSTED CALLER flag, which is related to safety for scripting.

Recommendations For Advantech WebAccess versions prior to 8.1 20160519, update to version 8.1 20160519 or later to resolve the issue. As a temporary workaround, consider restricting access to the ActiveX controls until a patch is applied.

Fix

Weakness Enumeration

CWE-17

Related Identifiers

BDU:2016-01682

CVE-2016-4525

Affected Products

Advantech Webaccess

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-4525 · Security Note
• https://osv.dev/vulnerability/CVE-2016-4525 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01682 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-173-01 · Note