CVE-2017-16720: advantech webaccess Path Traversal

Modified

Published 05-01-2018Last modified 05-08-2024

Vulnerability summary

CVE-2017-16720 is a high (CVSS 10.0) Path Traversal vulnerability in advantech webaccess. EPSS estimates a 50.32% chance of exploitation in the next 30 days, higher than 98.9% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk

90/100

0100

Critical · default modelHow is this calculated?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

50.32%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1exploit-database

Timeline

05-01-2018
PublishedVulnerability first disclosed.
05-08-2024
Last modifiedVulnerability information updated.

Description

A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within the directory structure of the target device.

CVSS metrics

2 scores · 1 source · 2 versions

v3.09.8v2.010.0

EPSS trend

Probability

50.32%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 50.32% on 22-09-2026

22-09-202622-10-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

exploit-databasewindowsVerified
Advantech WebAccess < 8.3 - Directory Traversal / Remote Code Execution
Maturity: poc

Weaknesses

CWE · root cause

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Affected systems

Advantech1 product

webaccess≤ 8.3.2

1 vendor · 1 product

References

5 links

www.exploit-db.com/exploits/44278/ExploitX Refsource EXPLOIT DBThird Party AdvisoryVDB Entry
www.securityfocus.com/bid/102424VDB EntryX Refsource BIDThird Party Advisory
ics-cert.us-cert.gov/advisories/ICSA-18-004-02X Refsource MISCBroken LinkThird Party AdvisoryUS Government Resource
www.tenable.com/security/research/tra-2018-23X Refsource MISCThird Party Advisory
www.zerodayinitiative.com/advisories/ZDI-18-024/Third Party Advisory