Vendor
Advantech
202 known vulnerabilities.
Products
54 results · Clear filters · Feed
-
Medium 4.2
Login Session Exhaustion
Successful exploitation of the vulnerability could allow an attacker to consume all available session slots and block other users from logging in, thereby preventing legitimate users from gaining access to the product.
-
Medium 5.0CVE-2025-48461 Public exploit
Weak Session Cookie Entropy
Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookies are predictable, potentially allowing the attackers to gain root, admin or user access and reset p…
-
Medium 6.5
A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advantech: EKI…
-
Medium 6.3
Advantech ADAM-5630 Missing Authentication for Critical Function
Advantech ADAM-5630 has built-in commands that can be executed without authenticating the user. These commands allow for restarting the operating system, rebooting the hardware, and stopping the execution. The commands can be sent to a simple HTTP request and…
-
Medium 5.7
Advantech ADAM-5630 Weak Encoding for Password
Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process.
-
Medium 5.7
Advantech ADAM-5550 Weak Encoding for Password
Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding.
-
Medium 6.4
Advantech WebAccess/SCADA SQL Injection
There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on th…
-
Medium 6.5
Advantech WebAccess Debug Messages Revealing Unnecessary Information
Advantech WebAccess version 9.1.3 contains an exposure of sensitive information to an unauthorized actor vulnerability that could leak user credentials.
-
Medium 6.5CVE-2022-3387 EPSS 14%
Advantech R-SeeNet Versions 2.4.19 and prior are vulnerable to path traversal attacks. An unauthorized attacker could r…
-
Medium 5.4
AzeoTech DAQFactory
This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage, and performing unintended browser action.
-
Medium 5.3
Advantech WebAccess/NMS Improper Authentication
WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an improper authentication vulnerability, which may allow unauthorized users to view resources monitored and controlled by the WebAccess/NMS, as well as IP addresses and names of all the devices managed v…
-
Medium 4.3
Advantech WebAccess SCADA
An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users.
-
Medium 6.5
Advantech WebAccess Improper Access Control
Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors.
-
Medium 5.0
Advantech WebAccess File and Directory Information Exposure
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named OpenUrlToBufferTimeout. This method takes a URL as a parameter and returns its contents to the caller in JavaScript. The URLs are accessed in the security context of the current browser session. The …