PT-2018-3101 · Advantech · Advantech Webaccess

Published 2018-10-23 · Updated 2019-10-09 · CVE-2018-14820

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 8.3.1 and earlier

Description The issue arises from insufficient input validation in a .dll component of the Advantech WebAccess software, allowing a remote attacker to delete arbitrary files. This can occur when the component is exploited, enabling the attacker to control file names or paths, which may result in the deletion of files.

Recommendations For Advantech WebAccess versions 8.3.1 and earlier, consider restricting access to the vulnerable .dll component until a patch is available. As a temporary workaround, limit the ability of the software to delete files based on external input to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-73

CWE-20

Related Identifiers

BDU:2019-04032

CVE-2018-14820

ZDI-18-1299

Affected Products

Advantech Webaccess

References · 9

• https://bdu.fstec.ru/vul/2019-04032 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-18-1299 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-14820 · Security Note
• https://osv.dev/vulnerability/CVE-2018-14820 · Vendor Advisory
• https://ics-cert.us-cert.gov/advisories/ICSA-18-296-01%2C · Note
• https://cxsecurity.com/cveshow/CVE-2018-14820 · Note
• http://securitytracker.com/id/1041939 · Note
• https://securityfocus.com/bid/105728 · Note
• http://securityfocus.com/bid/105728 · Note