Advantech WebAccess Vulnerabilities
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
describes (10)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-0773US | high7.5 | — | ||
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named
“CreateProcess.” This method contains validation to ensure an attacker
cannot run arbitrary command lines. After valid… | ||||
| CVE-2014-0772US | medium5.0 | — | ||
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named
OpenUrlToBufferTimeout. This method takes a URL as a parameter and
returns its contents to the caller in JavaScript. T… | ||||
| CVE-2014-0771US | medium5.0 | — | ||
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named
“OpenUrlToBuffer.” This method takes a URL as a parameter and returns
its contents to the caller in JavaScript. The UR… | ||||
| CVE-2014-0770US | high7.5 | — | ||
By providing an overly long string to the UserName parameter, an
attacker may be able to overflow the static stack buffer. The attacker
may then execute code on the target device… | ||||
| CVE-2014-0768US | high7.5 | — | ||
An attacker may pass an overly long value from the AccessCode2 argument
to the control to overflow the static stack buffer. The attacker may
then remotely execute arbitrary code. | ||||
| CVE-2014-0767US | high7.5 | — | ||
An attacker may exploit this vulnerability by passing an overly long
value from the AccessCode argument to the control. This will overflow
the static stack buffer. The attacker m… | ||||
| CVE-2014-0766US | high7.5 | — | ||
An attacker can exploit this vulnerability by copying an overly long
NodeName2 argument into a statically sized buffer on the stack to
overflow the static stack buffer. An attack… | ||||
| CVE-2014-0765US | high7.5 | — | ||
To exploit this vulnerability, the attacker sends data from the GotoCmd
argument to control. If the value of the argument is overly long, the
static stack buffer can be overflowe… | ||||
| CVE-2014-0764US | high7.5 | — | ||
By providing an overly long string to the NodeName parameter, an
attacker may be able to overflow the static stack buffer. The attacker
may then execute code on the target device… | ||||
| CVE-2014-0763US | high7.5 | Exploit | ||
An attacker using SQL injection may use arguments to construct queries
without proper sanitization. The DBVisitor.dll is exposed through SOAP
interfaces, and the exposed function… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-14-079-03 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-14-079-03 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (10)
- MitigationWebAccess
Advantech has created a new version (Version 7.2) that mitigates each of the vulnerabilities described above. Users may download this version from the following location at their web site: (http://webaccess.advantech.com/downloads.php?item=software)
http://webaccess.advantech.com/downloads.php?item=software - MitigationWebAccess
Advantech has created a new version (Version 7.2) that mitigates each of the vulnerabilities described above. Users may download this version from the following location at their web site: (http://webaccess.advantech.com/downloads.php?item=software)
http://webaccess.advantech.com/downloads.php?item=software - MitigationWebAccess
Advantech has created a new version (Version 7.2) that mitigates each of the vulnerabilities described above. Users may download this version from the following location at their web site: (http://webaccess.advantech.com/downloads.php?item=software)
http://webaccess.advantech.com/downloads.php?item=software - MitigationWebAccess
Advantech has created a new version (Version 7.2) that mitigates each of the vulnerabilities described above. Users may download this version from the following location at their web site: (http://webaccess.advantech.com/downloads.php?item=software)
http://webaccess.advantech.com/downloads.php?item=software - MitigationWebAccess
Advantech has created a new version (Version 7.2) that mitigates each of the vulnerabilities described above. Users may download this version from the following location at their web site: (http://webaccess.advantech.com/downloads.php?item=software)
http://webaccess.advantech.com/downloads.php?item=software - MitigationWebAccess
Advantech has created a new version (Version 7.2) that mitigates each of the vulnerabilities described above. Users may download this version from the following location at their web site: (http://webaccess.advantech.com/downloads.php?item=software)
http://webaccess.advantech.com/downloads.php?item=software - MitigationWebAccess
Advantech has created a new version (Version 7.2) that mitigates each of the vulnerabilities described above. Users may download this version from the following location at their web site: (http://webaccess.advantech.com/downloads.php?item=software)
http://webaccess.advantech.com/downloads.php?item=software - MitigationWebAccess
Advantech has created a new version (Version 7.2) that mitigates each of the vulnerabilities described above. Users may download this version from the following location at their web site: (http://webaccess.advantech.com/downloads.php?item=software)
http://webaccess.advantech.com/downloads.php?item=software - MitigationWebAccess
Advantech has created a new version (Version 7.2) that mitigates each of the vulnerabilities described above. Users may download this version from the following location at their web site: (http://webaccess.advantech.com/downloads.php?item=software)
http://webaccess.advantech.com/downloads.php?item=software - MitigationWebAccess
Advantech has created a new version (Version 7.2) that mitigates each of the vulnerabilities described above. Users may download this version from the following location at their web site: (http://webaccess.advantech.com/downloads.php?item=software)
http://webaccess.advantech.com/downloads.php?item=software
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan