Critical ICSA-21-217-04 3 CVEs

Advantech WebAccess SCADA

Published Aug 5, 2021 · Updated Aug 5, 2021

Vendor: Advantech Product: WebAccess/SCADA

Summary

Successful exploitation of these vulnerabilities could allow an attacker to hijack a user 's cookie/session tokens, gain unauthorized access to files and directories, and execute arbitrary code.

Vulnerabilities 3

Unscored —

CVE-2021-22674

The affected product is vulnerable to a relative path traversal condition, which may allow an attacker access to unauth…

Aug 10, 2021
Unscored —

CVE-2021-22676

UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting (XSS), which could allow an attacker to s…

Aug 10, 2021
Unscored —

CVE-2021-32943

The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute ar…

Aug 10, 2021

Revision history

2021-08-05 #1
ICSA-21-217-04 Advantech WebAccess SCADA

References

ICS Advisory ICSA-21-217-04 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-21-217-04
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B