PT-2019-3564 · Advantech · Advantech Webaccess

Mat Powell · Published 2019-06-27 · Updated 2023-03-02 · CVE-2019-10989

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 8.3.5 and prior

Description The issue is caused by a lack of proper validation of the length of user-supplied data, leading to multiple heap-based buffer overflow vulnerabilities. Exploitation of these vulnerabilities may allow remote code execution. The vulnerabilities are related to the webvrpcs process and are caused by insufficient checking of input data before it is copied into a dynamically allocated buffer of fixed length.

Recommendations For Advantech WebAccess versions 8.3.5 and prior, consider disabling the webvrpcs process as a temporary workaround to minimize the risk of exploitation until a patch is available. Restrict access to the affected modules to minimize the risk of remote code execution. Avoid using the affected functions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Memory Corruption

Heap Based Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

Related Identifiers

BDU:2019-03765

CVE-2019-10989

ZDI-19-590

ZDI-19-591

Affected Products

Advantech Webaccess

References · 7

• https://zerodayinitiative.com/advisories/ZDI-19-590 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-19-591 · Security Note
• https://osv.dev/vulnerability/CVE-2019-10989 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-10989 · Security Note
• https://bdu.fstec.ru/vul/2019-03765 · Security Note
• https://securitylab.ru/news/499681.php · Note
• https://us-cert.gov/ics/advisories/icsa-19-178-05 · Note