PT-2019-2910 · Advantech · Advantech Webaccess Hmi Designer

Mat Powell · Published 2019-01-15 · Updated 2023-03-03 · CVE-2019-10961

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Advantech WebAccess HMI Designer version 2.1.9.23 and prior

Description The issue is related to the processing of specially crafted MCR files, which may cause the system to write outside the intended buffer area, allowing remote code execution. This can be exploited by an attacker to execute arbitrary code in the target system using maliciously crafted MCR files or a specially formed web page.

Recommendations For Advantech WebAccess HMI Designer version 2.1.9.23 and prior, update to a version that fixes the MCR file parsing out-of-bounds write issue to prevent remote code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BDU:2019-02882

CVE-2019-10961

ZDI-19-691

Affected Products

Advantech Webaccess Hmi Designer

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-10961 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10961 · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsa-19-213-01 · Patch
• https://zerodayinitiative.com/advisories/ZDI-19-691 · Security Note
• https://bdu.fstec.ru/vul/2019-02882 · Security Note