PT-2018-3100 · Advantech · Advantech Webaccess

Published 2018-10-23 · Updated 2019-10-09 · CVE-2018-14828

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 8.3.1 and earlier

Description The issue is related to improper privilege management, which may allow an attacker to access files and perform actions at a system administrator level. This could enable an attacker to elevate their privileges and gain unauthorized access to files.

Recommendations For Advantech WebAccess versions 8.3.1 and earlier, consider restricting access to sensitive files and system administrator functions until a patch is available. As a temporary workaround, review and modify the access control settings to prevent unauthorized privilege escalation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2019-04031

CVE-2018-14828

ZDI-18-1319

Affected Products

Advantech Webaccess

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2018-14828 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1319 · Security Note
• https://bdu.fstec.ru/vul/2019-04031 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14828 · Vendor Advisory
• https://cxsecurity.com/cveshow/CVE-2018-14828 · Note
• https://us-cert.gov/ics/advisories/ICSA-18-296-01 · Note
• https://ics-cert.us-cert.gov/advisories/ICSA-18-296-01%2C · Note
• http://securitytracker.com/id/1041939 · Note
• https://securityfocus.com/bid/105728 · Note
• http://securityfocus.com/bid/105728 · Note