Vendor
Advantech
202 known vulnerabilities.
Products
34 results · Clear filters · Feed
-
Critical 9.2
A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.
-
Critical 9.3
A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.
-
Critical 9.2
A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code executio…
-
Critical 9.3
A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.
-
Critical 9.3
Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Comman…
-
Critical 9.9
Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection
A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_2025…
-
Critical 9.9
Advantech WISE-6610-NB Basic Station Certificate-Deletion basicstation_apply command injection
A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1_2025…
-
Critical 9.2
A stack-based buffer overflow vulnerability in the Cookie parsing methods could allow an unauthenticated attacker to ac…
-
Critical 9.2
A stack-based buffer overflow vulnerability in the log message functionality could allow an unauthenticated attacker to…
-
Critical 9.2
A stack-based buffer overflow vulnerability in the password functionality could allow an unauthenticated attacker to ac…
-
Critical 9.8
Advantech｜Hospital Quering Management - Missing Authentication
Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation.
-
Critical 10.0
Execution of arbitrary SQL commands
Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet, potentially affecting data confidentiality, integrity, an…
-
Critical 10.0
Advantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication Bypass
Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain …
-
Critical 9.3
Advantech iView < v5.7.04 Build 6425 ztp_search_value Parameter SQL Injection RCE
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘ztp_search_value’ parameter to th…
-
Critical 9.3
Advantech iView < v5.7.04 Build 6425 search_term Parameter SQL Injection RCE
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘search_term’ parameter to the ‘Ne…
-
Critical 9.3
Advantech iView < v5.7.04 Build 6425 getInventoryReportData Parameter SQL Injection RCE
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘getInventoryReportData’ parameter…
-
Critical 9.6
Unauthenticated Firmware Upload
Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware through a public update page, potentially leading to backdoor installation or privilege escalation.
-
Critical 9.8
A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by…
-
Critical 9.8
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered af…
-
Critical 9.8
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered af…
-
Critical 9.8
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered af…
-
Critical 9.8
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered af…
-
Critical 9.8
A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered af…
-
Critical 9.8CVE-2023-5642 EPSS 18%
Advantech R-SeeNet Unauthenticated Read/Write
Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitive information.
-
Critical 9.0
Stored Cross-Site Scripting
Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the ping tool of the web-interface.
-
Critical 9.0
Stored Cross-Site Scripting
Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticated users in the device name field of the web-interface.
-
Critical 9.8
CVE-2023-1437
All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote fi…
-
Critical 9.8
Advantech R-SeeNet Use of Hard-coded Credentials
Advantech R-SeeNet versions 2.4.22 is installed with a hidden root-level user that is not available in the users list. This hidden user has a password that cannot be changed by users.
-
Critical 9.8
Advantech R-SeeNet Versions 2.4.17 and prior are vulnerable to a stack-based buffer overflow. An unauthorized attacker …
-
Critical 9.8
Advantech R-SeeNet Versions 2.4.17 and prior are vulnerable to a stack-based buffer overflow. An unauthorized attacker …
-
Critical 9.8
Advantech ADAM-3600
The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server login and perform further actions.
-
Critical 9.8CVE-2021-38389 EPSS 10%
Advantech WebAccess
Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code.
-
Critical 9.8
Advantech WebAccess
Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code.
-
Critical 9.0
Advantech WebAccess Cleartext Storage of Sensitive Information in Memory
upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code.