Skip to content
OpenAdvisories
Critical ICSA-20-098-01 8 CVEs

Advantech WebAccess/NMS

Published Apr 7, 2020 · Updated Apr 7, 2020

Vendor: Advantech Product: WebAccess/NMS

Summary

Successful exploitation of these vulnerabilities may allow an attacker to gain remote code execution, upload files, delete files, cause a denial-of-service condition, and create an admin account for the application.

Vulnerabilities 8

  • Unscored —
    CVE-2020-10603

    WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject syste…

  • Unscored —
    CVE-2020-10617

    There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0…

  • Unscored —
    CVE-2020-10619 EPSS 14%

    An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) con…

  • Unscored —
    CVE-2020-10621

    Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to 3.0.2).

  • Unscored —
    CVE-2020-10623

    Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (version…

  • Unscored —
    CVE-2020-10625

    WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account.

  • Unscored —
    CVE-2020-10629

    WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. Specially crafted XML input could allow an attacke…

  • Unscored —
    CVE-2020-10631

    An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.…

Revision history

  1. #1

    ICSA-20-098-01 Advantech WebAccessNMS

References