PT-2018-14260 · Advantech · Webaccess

Published 2018-10-29 · Updated 2019-10-09 · CVE-2018-17908

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebAccess versions 8.3.2 and prior

Description The issue arises during the installation of the application, where the installer disables user access control but fails to re-enable it after the installation is complete. This could allow an attacker to run elevated arbitrary code, potentially leading to privilege escalation.

Recommendations For WebAccess versions 8.3.2 and prior, consider re-enabling user access control manually after installation as a temporary workaround. Restrict access to sensitive areas of the system to minimize the risk of exploitation until a proper fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2018-17908

ZDI-18-1329

ZDI-18-1331

Affected Products

Webaccess

References · 7

• https://osv.dev/vulnerability/CVE-2018-17908 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-18-1331 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-17908 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1329 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-298-02 · Note
• http://securityfocus.com/bid/105736 · Note
• http://securitytracker.com/id/1041957 · Note