Advantech/BroadWin WebAccess before 7.0 allows remote attackers to (1) enable date and time syncing or (2) disable date and time syncing via a crafted URL.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2012-0273
http://www.us-cert.gov/control_systems/pdf/ICSA-12-047-01.pdf