Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 10012 RPC call.

The Advantech WebAccess/SCADA Network Service (webvrpcs.exe) running on the remote host is affected by a stack-based buffer overflow vulnerability due to improper validation of user-supplied data when processing an IOCTL 10012 RPC request. An unauthenticated, remote attacker can exploit this, via a series of crafted requests, to cause a denial of service condition or the execution of arbitrary code.

Note that the software is reportedly affected by additional vulnerabilities; however, this plugin has not tested for these.

Detections

Analytics

CVE-2019-3953

critical

Tenable Plugins

critical