PT-2017-12667 · Advantech · Webaccess

Published 2017-11-06 · Updated 2019-10-09 · CVE-2017-12719

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions prior to V8.2 20170817

Description An Untrusted Pointer Dereference issue allows a remote attacker to execute code, causing the application to become unavailable. This issue can lead to remote code execution, making the system inaccessible.

Recommendations For versions prior to V8.2 20170817, update to version V8.2 20170817 or later to resolve the issue. As a temporary workaround, consider restricting access to the webvrpcs drawsrv service to minimize the risk of exploitation.

Fix

NULL Pointer Dereference

Untrusted Pointer Dereference

Weakness Enumeration

CWE-476

CWE-822

Related Identifiers

CVE-2017-12719

ZDI-17-939

ZDI-17-940

Affected Products

Webaccess

References · 6

• https://zerodayinitiative.com/advisories/ZDI-17-940 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-12719 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-939 · Security Note
• https://osv.dev/vulnerability/CVE-2017-12719 · Vendor Advisory
• http://securityfocus.com/bid/101685 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-17-306-02 · Note