PT-2019-15301 · Advantech · Advantech Diaganywhere Server

Z0Mb1E · Published 2019-12-13 · Updated 2020-10-22 · CVE-2019-18257

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech DiagAnywhere Server versions 3.07.11 and prior

Description The issue is related to multiple stack-based buffer overflow vulnerabilities in the file transfer service of Advantech DiagAnywhere Server. These vulnerabilities could allow an unauthenticated attacker to execute arbitrary code with the privileges of the user running the server. The vulnerabilities exist in various functions, including FOLDER CREATE, FILE OPEN RO, FOLDER REMOVE, FILE CREATE, and SET CURR DIR.

Recommendations For Advantech DiagAnywhere Server versions 3.07.11 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Stack Overflow

Memory Corruption

Weakness Enumeration

CWE-121

CWE-787

Related Identifiers

CVE-2019-18257

ZDI-19-1017

ZDI-19-1018

ZDI-19-1019

ZDI-19-1020

ZDI-19-1021

Affected Products

Advantech Diaganywhere Server

References · 8

• https://zerodayinitiative.com/advisories/ZDI-19-1019 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2019-18257 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-1018 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-1017 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-1020 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18257 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-19-1021 · Security Note
• https://us-cert.gov/ics/advisories/icsa-19-346-01 · Note