Advantech WebAccess/NMS
view advisory published 2020-04-07
Successful exploitation of these vulnerabilities may allow an attacker to gain remote code execution, upload files, delete files, cause a denial-of-service condition, and create an admin account for the application.
01
describes (8)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-10631US | critical9.8 | — | ||
An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2) control. | ||||
| CVE-2020-10629US | high7.5 | — | ||
WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive files. | ||||
| CVE-2020-10625US | critical9.8OT elevated | — | ||
WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account. | ||||
| CVE-2020-10623US | medium6.5 | — | ||
Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information. | ||||
| CVE-2020-10619US | critical9.1 | — | ||
An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control. | ||||
| CVE-2020-10617US | high7.5 | — | ||
There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information. | ||||
| CVE-2020-10603US | high8.8 | — | ||
WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject system commands remotely. | ||||
| CVE-2020-10621US | critical9.8 | — | ||
Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to 3.0.2). | ||||
02
references
External citations — patches, advisories, analysis.
03
remediations (8)
- MitigationWebAccess/NMS
Advantech recommends updating to Version 3.0.2
https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.advantech.com%2Fproducts%2F828e8fed-6112-4965-a485-1b8551fe0b25%2Fwebaccess-nms%2Fmod_a575e526-9b42-4747-b8f0-c13431751a03&data=02%7C01%7Ctyler.thomas%40inl.gov%7C700a1a43391248f5431c08d7d13637f1%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637207903155520284&sdata=BSOHWDixxV1eToxVFpEBFFiamr31TOVYyxF84keaD6Q%3D&reserved=0 - MitigationWebAccess/NMS
Advantech recommends updating to Version 3.0.2
https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.advantech.com%2Fproducts%2F828e8fed-6112-4965-a485-1b8551fe0b25%2Fwebaccess-nms%2Fmod_a575e526-9b42-4747-b8f0-c13431751a03&data=02%7C01%7Ctyler.thomas%40inl.gov%7C700a1a43391248f5431c08d7d13637f1%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637207903155520284&sdata=BSOHWDixxV1eToxVFpEBFFiamr31TOVYyxF84keaD6Q%3D&reserved=0 - MitigationWebAccess/NMS
Advantech recommends updating to Version 3.0.2
https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.advantech.com%2Fproducts%2F828e8fed-6112-4965-a485-1b8551fe0b25%2Fwebaccess-nms%2Fmod_a575e526-9b42-4747-b8f0-c13431751a03&data=02%7C01%7Ctyler.thomas%40inl.gov%7C700a1a43391248f5431c08d7d13637f1%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637207903155520284&sdata=BSOHWDixxV1eToxVFpEBFFiamr31TOVYyxF84keaD6Q%3D&reserved=0 - MitigationWebAccess/NMS
Advantech recommends updating to Version 3.0.2
https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.advantech.com%2Fproducts%2F828e8fed-6112-4965-a485-1b8551fe0b25%2Fwebaccess-nms%2Fmod_a575e526-9b42-4747-b8f0-c13431751a03&data=02%7C01%7Ctyler.thomas%40inl.gov%7C700a1a43391248f5431c08d7d13637f1%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637207903155520284&sdata=BSOHWDixxV1eToxVFpEBFFiamr31TOVYyxF84keaD6Q%3D&reserved=0 - MitigationWebAccess/NMS
Advantech recommends updating to Version 3.0.2
https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.advantech.com%2Fproducts%2F828e8fed-6112-4965-a485-1b8551fe0b25%2Fwebaccess-nms%2Fmod_a575e526-9b42-4747-b8f0-c13431751a03&data=02%7C01%7Ctyler.thomas%40inl.gov%7C700a1a43391248f5431c08d7d13637f1%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637207903155520284&sdata=BSOHWDixxV1eToxVFpEBFFiamr31TOVYyxF84keaD6Q%3D&reserved=0 - MitigationWebAccess/NMS
Advantech recommends updating to Version 3.0.2
https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.advantech.com%2Fproducts%2F828e8fed-6112-4965-a485-1b8551fe0b25%2Fwebaccess-nms%2Fmod_a575e526-9b42-4747-b8f0-c13431751a03&data=02%7C01%7Ctyler.thomas%40inl.gov%7C700a1a43391248f5431c08d7d13637f1%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637207903155520284&sdata=BSOHWDixxV1eToxVFpEBFFiamr31TOVYyxF84keaD6Q%3D&reserved=0 - MitigationWebAccess/NMS
Advantech recommends updating to Version 3.0.2
https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.advantech.com%2Fproducts%2F828e8fed-6112-4965-a485-1b8551fe0b25%2Fwebaccess-nms%2Fmod_a575e526-9b42-4747-b8f0-c13431751a03&data=02%7C01%7Ctyler.thomas%40inl.gov%7C700a1a43391248f5431c08d7d13637f1%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637207903155520284&sdata=BSOHWDixxV1eToxVFpEBFFiamr31TOVYyxF84keaD6Q%3D&reserved=0 - MitigationWebAccess/NMS
Advantech recommends updating to Version 3.0.2
https://gcc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.advantech.com%2Fproducts%2F828e8fed-6112-4965-a485-1b8551fe0b25%2Fwebaccess-nms%2Fmod_a575e526-9b42-4747-b8f0-c13431751a03&data=02%7C01%7Ctyler.thomas%40inl.gov%7C700a1a43391248f5431c08d7d13637f1%7C4cf464b7869a42368da2a98566485554%7C0%7C0%7C637207903155520284&sdata=BSOHWDixxV1eToxVFpEBFFiamr31TOVYyxF84keaD6Q%3D&reserved=0
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan