PT-2019-16794 · Advantech · Webaccess

Published 2019-04-09 · Updated 2019-10-09 · CVE-2019-3940

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech WebAccess version 8.3.4

Description The issue allows an unauthenticated, remote attacker to execute arbitrary code via file upload attacks using an unauthenticated RPC call.

Recommendations For Advantech WebAccess version 8.3.4, consider restricting access to the RPC call to prevent unauthenticated file uploads until a patch is available.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-3940

Affected Products

Webaccess

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2019-3940 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3940 · Vendor Advisory
• http://securityfocus.com/bid/107847 · Note
• https://tenable.com/security/research/tra-2019-15 · Note