PT-2020-14828 · Advantech · Advantech Webaccess Hmi Designer

Kimiya · Published 2020-08-06 · Updated 2022-10-06 · CVE-2020-16229

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech WebAccess HMI Designer versions 2.1.9.31 and prior

Description The issue arises from the processing of specially crafted project files that lack proper validation of user-supplied data, potentially leading to a type confusion condition. This condition may result in remote code execution, disclosure or modification of information, or cause the application to crash.

Recommendations For Advantech WebAccess HMI Designer versions 2.1.9.31 and prior, consider implementing proper validation of user-supplied data in project files to prevent type confusion conditions. As a temporary workaround, restrict the processing of project files from untrusted sources until a fix is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

CVE-2020-16229

ZDI-20-954

Affected Products

Advantech Webaccess Hmi Designer

References · 4

• https://osv.dev/vulnerability/CVE-2020-16229 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-20-954 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-16229 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-20-219-02 · Note