Critical ICSA-18-296-01 4 CVEs

Advantech WebAccess

Published Oct 23, 2018 · Updated Oct 23, 2018

Vendor: Advantech Product: WebAccess

Summary

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, access files and perform actions at a privileged level, or delete files on the system.

Vulnerabilities 4

Unscored —

CVE-2018-14806

Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitra…

Advantech Advantech WebAccess

Oct 23, 2018
Unscored —

CVE-2018-14816

Advantech WebAccess 8.3.1 and earlier has several stack-based buffer overflow vulnerabilities that have been identified…

Advantech Advantech WebAccess

Oct 23, 2018
Unscored —

CVE-2018-14820

Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path…

Advantech Advantech WebAccess

Oct 23, 2018
Unscored —

CVE-2018-14828

Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker t…

Advantech Advantech WebAccess

Oct 23, 2018

Revision history

2018-10-23 #1
ICSA-18-296-01 Advantech WebAccess

References

ICS Advisory ICSA-18-296-01 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-18-296-01
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B