Advantech WebAccess Vulnerabilities
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-2368US | medium5.0 | — | ||
The BrowseFolder method in the bwocxrun ActiveX control in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call. | ||||
| CVE-2014-2367US | medium4.3 | — | ||
The ChkCookie subroutine in an ActiveX control in broadweb/include/gChkCook.asp in Advantech WebAccess before 7.2 allows remote attackers to read arbitrary files via a crafted call… | ||||
| CVE-2014-2366US | medium4.0 | — | ||
upAdminPg.asp in Advantech WebAccess before 7.2 allows remote authenticated users to discover credentials by reading HTML source code. | ||||
| CVE-2014-2365US | medium5.5 | — | ||
Unspecified vulnerability in Advantech WebAccess before 7.2 allows remote authenticated users to create or delete arbitrary files via unknown vectors. | ||||
| CVE-2014-2364US | high7.5 | Exploit | ||
Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter,… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-14-198-02 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-14-198-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (5)
- MitigationAdvantech WebAccess
Advantech released a new WebAccess Installation Package v7.2 on June 6, 2014, that removes some vulnerable ActiveX components and resolves the vulnerabilities within others. The download link for v7.2 is available at: (http://webaccess.advantech.com/)
http://webaccess.advantech.com/ - MitigationAdvantech WebAccess
Advantech released a new WebAccess Installation Package v7.2 on June 6, 2014, that removes some vulnerable ActiveX components and resolves the vulnerabilities within others. The download link for v7.2 is available at: (http://webaccess.advantech.com/)
http://webaccess.advantech.com/ - MitigationAdvantech WebAccess
Advantech released a new WebAccess Installation Package v7.2 on June 6, 2014, that removes some vulnerable ActiveX components and resolves the vulnerabilities within others. The download link for v7.2 is available at: (http://webaccess.advantech.com/)
http://webaccess.advantech.com/ - MitigationAdvantech WebAccess
Advantech released a new WebAccess Installation Package v7.2 on June 6, 2014, that removes some vulnerable ActiveX components and resolves the vulnerabilities within others. The download link for v7.2 is available at: (http://webaccess.advantech.com/)
http://webaccess.advantech.com/ - MitigationAdvantech WebAccess
Advantech released a new WebAccess Installation Package v7.2 on June 6, 2014, that removes some vulnerable ActiveX components and resolves the vulnerabilities within others. The download link for v7.2 is available at: (http://webaccess.advantech.com/)
http://webaccess.advantech.com/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan