PT-2020-14807 · Advantech · Advantech Webaccess Hmi Designer

Kimiya · Published 2020-08-06 · Updated 2023-01-27 · CVE-2020-16207

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech WebAccess HMI Designer versions 2.1.9.31 and prior

Description The issue is related to multiple heap-based buffer overflow vulnerabilities. These vulnerabilities can be exploited by opening specially crafted project files, which may cause the heap to overflow. This overflow may allow remote code execution, lead to the disclosure or modification of information, or cause the application to crash.

Recommendations For Advantech WebAccess HMI Designer versions 2.1.9.31 and prior, consider avoiding the use of untrusted project files until a patch is available. As a temporary workaround, restrict access to the file parsing functionality to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-122

CWE-787

Related Identifiers

CVE-2020-16207

ZDI-20-950

ZDI-20-951

ZDI-20-955

ZDI-20-958

ZDI-20-959

Affected Products

Advantech Webaccess Hmi Designer

References · 8

• https://zerodayinitiative.com/advisories/ZDI-20-959 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-950 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-958 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-951 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-16207 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-20-955 · Security Note
• https://osv.dev/vulnerability/CVE-2020-16207 · Vendor Advisory
• https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02 · Note