Multiple vulnerabilities in Advantech WebAccess

Multiple vulnerabilities have been identified in Advantech WebAccess, an industrial software solution. Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, gain access to files, perform actions with privileged access or delete files on a target system.

The most dangerous vulnerabilities affect Advantech WebAccess versions 8.3.1 and prior. The issues are stack-based buffer overflow (CVE-2018-14816) and path traversal (CVE-2018-14806). Both have been assigned CVSS v.3 base scores of 9.8. Other flaws identified in the solution include improper privilege management (CVE-2018-14828) and external control of file name or path issue in a .dll component of the product (CVE-2018-14820). The CVSS v.3 base score calculated for these vulnerabilities is 7.8 and 7.5, respectively.

More vulnerabilities have been identified in Advantech WebAccess version 8.3.2, which also affect earlier versions of the solution. They include improper access control (CVE-2018-17908) and buffer overflow (CVE-2018-17910). The former issue is due to the application installer disabling user access control during installation and failing to re-enable it after the installation is complete. This could allow an attacker to run arbitrary code with elevated privileges. This vulnerability has been assigned a CVSS v.3 base score of 8.4. The latter flaw has to do with the failure to validate the length of user-supplied data properly, causing a stack-based buffer overflow condition that allows for arbitrary remote code execution. A CVSS v.3 base score of 7.8 has been calculated for this vulnerability.

All the above vulnerabilities have been fixed by the vendor in version 8.3.3 of the product, which is available for download on Advantech’s website.

Source: ICS-CERT