PT-2020-12983 · Advantech · Advantech Webaccess Node

Z0Mb1E · Published 2020-05-08 · Updated 2020-05-11 · CVE-2020-12014

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advantech WebAccess Node versions 8.4.4 and prior Advantech WebAccess Node version 9.0.0

Description The issue arises from improper input sanitization, which may allow an attacker to inject SQL commands. This can lead to SQL injection and information disclosure vulnerabilities. Specifically, certain IOCTL commands, such as IOCTL 0x00013c74, IOCTL 0x00013c75, IOCTL 0x00013c71, IOCTL 0x00013c76, and IOCTL 0x00013c77, are affected.

Recommendations For Advantech WebAccess Node versions 8.4.4 and prior, update to a version later than 8.4.4 to resolve the issue. For Advantech WebAccess Node version 9.0.0, consider disabling the BwWebSvc service until a patch is available. As a temporary workaround, restrict access to the affected IOCTL commands to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2020-12014

ZDI-20-613

ZDI-20-614

ZDI-20-615

Affected Products

Advantech Webaccess Node

References · 7

• https://zerodayinitiative.com/advisories/ZDI-20-613 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-12014 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-615 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-614 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12014 · Vendor Advisory
• https://us-cert.gov/ics/advisories/icsa-20-128-01 · Note
• https://t.me/cvenotify/3665 · Telegram Post