PT-2020-12975 · Advantech · Advantech Webaccess Node

Z0Mb1E · Published 2020-05-08 · Updated 2021-09-23 · CVE-2020-12002

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech WebAccess Node versions 8.4.4 and prior Advantech WebAccess Node version 9.0.0

Description Multiple stack-based buffer overflow vulnerabilities exist due to a lack of proper validation of the length of user-supplied data, which may allow remote code execution.

Recommendations For Advantech WebAccess Node versions 8.4.4 and prior, update to a version later than 8.4.4 to resolve the issue. For Advantech WebAccess Node version 9.0.0, update to a version later than 9.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the affected system until a patch is available.

Fix

RCE

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787

CWE-121

Related Identifiers

CVE-2020-12002

ZDI-20-590

ZDI-20-591

ZDI-20-592

ZDI-20-619

ZDI-20-622

ZDI-20-624

ZDI-20-625

ZDI-20-633

ZDI-20-634

Affected Products

Advantech Webaccess Node

References · 14

• https://zerodayinitiative.com/advisories/ZDI-20-592 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-633 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-622 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-624 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-591 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-625 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-12002 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-590 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-634 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-619 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12002 · Vendor Advisory
• https://t.me/cvenotify/3662 · Telegram Post
• https://us-cert.gov/ics/advisories/icsa-20-128-01 · Note
• https://t.me/cvenotify/21337 · Telegram Post