Skip to content
OpenAdvisories
High ICSA-21-173-01 5 CVEs

Advantech WebAccess HMI Designer (Update A)

Published Jun 22, 2021 · Updated Nov 9, 2021 · Revision 2

Vendor: Advantech Product: WebAccess HMI Designer

Summary

Successful exploitation of these vulnerabilities could result in memory corruption, code execution, hijacking of user 's cookie/session tokens, and unintended browser action.

Vulnerabilities 5

  • High 7.8
    CVE-2021-42706

    AzeoTech DAQFactory

    This vulnerability could allow an attacker to disclose information and execute arbitrary code on affected installations of WebAccess/MHI Designer

    Advantech HMI Designer
  • Medium 5.4
    CVE-2021-42703

    AzeoTech DAQFactory

    This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action.

    Advantech HMI Designer
  • Unscored —
    CVE-2021-33000

    Parsing a maliciously crafted project file may cause a heap-based buffer overflow, which may allow an attacker to perfo…

  • Unscored —
    CVE-2021-33002

    Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arb…

  • Unscored —
    CVE-2021-33004

    The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied fil…

Revision history

  1. #2

    ICSA-21-173-01 Advantech WebAccess HMI Designer (Update A)

  2. #1

    ICSA-21-173-01 Advantech WebAccess HMI Designer

References