Advantech Webaccess\/Scada vulnerabilities, page 2
36 vulnerabilities
Known vulnerabilities in Advantech Webaccess\/Scada, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2020-13552advantechwebaccess\/scada
EPSS score0.50%
An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege escalation via multiple service executables in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.CVE-2020-25161advantechwebaccess\/scadaEPSS score1.56%
The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a path used in an operation on the filesystem and remotely execute code as an administrator.CVE-2024-2453advantechwebaccess\/scadaEPSS score0.30%
There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database.CVE-2019-6554advantechwebaccess+1EPSS score1.57%
Advantech WebAccess/SCADA, Versions 8.3.5 and prior. An improper access control vulnerability may allow an attacker to cause a denial-of-service condition.CVE-2019-6521advantechwebaccess\/scadaEPSS score1.93%
WebAccess/SCADA, Version 8.3. Specially crafted requests could allow a possible authentication bypass that could allow an attacker to obtain and manipulate sensitive information.CVE-2019-6550advantechwebaccess+1EPSS score6.09%
Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code execution.CVE-2019-6552advantechwebaccess+1EPSS score3.27%
Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, may allow remote code execution.CVE-2019-6519advantechwebaccess\/scadaEPSS score2.81%
WebAccess/SCADA, Version 8.3. An improper authentication vulnerability exists that could allow a possible authentication bypass allowing an attacker to upload malicious data.CVE-2019-6523advantechwebaccess\/scadaEPSS score2.00%
WebAccess/SCADA, Version 8.3. The software does not properly sanitize its inputs for SQL commands.CVE-2019-3975advantechwebaccess+1EPSS score4.57%
Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message.CVE-2026-6888advantechecowatch saas-composer+7EPSS score0.70%
Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to
execute arbitrary commands via a specific interface,
potentially enabling the attacker to access, modify, or delete sensitive
information within the database.CVE-2023-2866advantechwebaccess+1EPSS score0.14%
If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server.CVE-2023-1437advantechwebaccess\/scadaEPSS score2.80%
All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute commands and overwrite files.CVE-2023-22450advantechwebaccess\/scadaEPSS score0.83%
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an ASP script file to a webserver when logged in as manager user, which can lead to arbitrary code execution.CVE-2023-32628advantechwebaccess\/scadaEPSS score0.71%
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of a certificate file to ASP when uploading it, which can lead to remote code execution.CVE-2023-32540advantechwebaccess\/scadaEPSS score0.90%
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the operating system (including system files), inject code into an XLS file, and modify the file extension, which could lead to arbitrary code execution.