WebAccess/SCADA vulnerabilities
6 known vulnerabilities in WebAccess/SCADA from Advantech. 6 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.2 High severity
SaaS Composer: Improper Neutralization of Special Elements used in an SQL Command
Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to execute arbitrary commands via a specific interface, potentially enabling the attacker to access, modify, or delete sensitive information within the datab
- 9.8 Critical severity
WebAccess/SCADA: Improper Restriction of Operations within the Bounds of a Memory Buffer
All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote fil
- 7.8 High severity
WebAccess/SCADA: Insufficient Verification of Data Authenticity
If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server.
- 9.8 Critical severity
WebAccess/SCADA: Unrestricted Upload of File with Dangerous Type
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of a certificate file to ASP when uploading it, which can lead to remote code execution.
- 9.8 Critical severity
WebAccess/SCADA: Improper Control of Generation of Code
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the operating system (including system files), inject code into an XLS file, and modify the file extension,
- 7.2 High severity
WebAccess/SCADA: Unrestricted Upload of File with Dangerous Type
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an ASP script file to a webserver when logged in as manager user, which can lead to arbitrary code execution.