PT-2016-4422 · Advantech · Advantech Webaccess

Kimiya + 1 · Published 2016-01-15 · Updated 2016-12-03 · CVE-2016-0855

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to 8.1

Description The issue allows remote attackers to list arbitrary virtual-directory files via unspecified vectors. It also enables directory traversal, which can lead to arbitrary file deletion, denial of service, and information disclosure. The vulnerability is related to the Dashboard Viewer and affects various functions such as addFolder, removeFolder, openWidget, and removeFile.

Recommendations For Advantech WebAccess versions prior to 8.1, update to version 8.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the Dashboard Viewer functions, specifically addFolder, removeFolder, openWidget, and removeFile, until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2016-0855

ZDI-16-122

ZDI-16-123

ZDI-16-124

ZDI-16-125

ZDI-16-126

Affected Products

Advantech Webaccess

References · 13

• https://zerodayinitiative.com/advisories/ZDI-16-125 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-16-122 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0855 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0855 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-16-126 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-16-124 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-16-123 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-16-126 · Note
• http://zerodayinitiative.com/advisories/ZDI-16-122 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01 · Note
• http://zerodayinitiative.com/advisories/ZDI-16-125 · Note
• http://zerodayinitiative.com/advisories/ZDI-16-124 · Note
• http://zerodayinitiative.com/advisories/ZDI-16-123 · Note