PT-2018-1177 · Advantech · Advantech Webaccess Hmi Designer

Steven Seeley · Published 2018-04-24 · Updated 2019-10-09 · CVE-2018-8837

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech WebAccess HMI Designer version 2.1.7.32 and prior

Description The issue is caused by writing data outside the intended buffer area in memory when processing specially crafted .pm3 files. This may allow remote code execution. The vulnerability can be exploited by an attacker using specially crafted .pm3 files to execute arbitrary code.

Recommendations For Advantech WebAccess HMI Designer version 2.1.7.32 and prior, consider avoiding the use of .pm3 files from untrusted sources until a patch is available. As a temporary workaround, restrict access to the system to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2018-00632

CVE-2018-8837

Affected Products

Advantech Webaccess Hmi Designer

References · 8

• https://osv.dev/vulnerability/CVE-2018-8837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8837 · Security Note
• https://bdu.fstec.ru/vul/2018-00632 · Security Note
• https://threatpost.ru/three-vulnerabilities-found-in-advantech-webaccess-hmi-designer/25835 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-114-03 · Note
• http://securityfocus.com/bid/103972 · Note
• https://cybersecurity-help.cz/vdb/SB2018042517?affChecked=1 · Note
• https://securitylab.ru/vulnerability/492920.php · Note