Detections
Analytics
Advantech WebAccess < 8.3.5 Multiple Vulnerabilities (ICSA-19-092-01)
critical Nessus Network Monitor Plugin ID 700723
Synopsis
The detected version of Advantech WebAccess may be affected by multiple attack vectors.Description
The installed version of Advantech WebAccess is prior to 8.3.5 and is affected by the following vulnerabilities :- Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, may allow remote code execution. (CVE-2019-6552)
- Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code execution. (CVE-2019-6550)
- An improper access control vulnerability may allow an attacker to cause a denial-of-service condition. (CVE-2019-6554)
Solution
Upgrade to Advantech WebAccess version 8.3.5 or later.See Also
Plugin Details
Severity: Critical
ID: 700723
Family: SCADA
Published: 5/27/2019
Updated: 5/27/2019
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:advantech:advantech_webaccess
Patch Publication Date: 4/2/2019
Vulnerability Publication Date: 4/2/2019