📦

webaccess

Vendor: advantech

Login to add this product to WatchStack
Actively Exploited 0 CISA KEV List
PoC / Exploits 11 Code Available
Total RCEs 29 Remote Access
Total CVEs 431 Total Indexed
Avg. EPSS 5.62% Exploit Prob.
Latest CVE CVE-2023-4215 Oct 17

Security Vulnerability Index

Page 5 / 44
6.5 CVSS
CVE-2018-15705
RCE Exploit Found

WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesystem due to a directory traversal vulnerability in the writeFile API. An attacker can use this vulnerability to remotely execute arbitrary code.

EPSS: 12.24%
7.8 CVSS
CVE-2018-17910
RCE

WebAccess Versions 8.3.2 and prior. The application fails to properly validate the length of user-supplied data, causing a buffer overflow condition that allows for arbitrary remote code execution.

EPSS: 5.22%
7.8 CVSS
CVE-2018-17908

WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it after the installation is complete. This could allow an attacker to run elevated arbitrary code.

EPSS: 0.45%
7.8 CVSS
CVE-2018-14828

Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files and perform actions at a system administrator level.

EPSS: 0.41%
7.5 CVSS
CVE-2018-14820

Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbitrary file deletion when processing.

EPSS: 2.20%
9.8 CVSS
CVE-2018-14816
RCE

Advantech WebAccess 8.3.1 and earlier has several stack-based buffer overflow vulnerabilities that have been identified, which may allow an attacker to execute arbitrary code.

EPSS: 4.13%
9.8 CVSS
CVE-2018-14806
RCE

Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary code.

EPSS: 4.78%
8.8 CVSS
CVE-2018-15704
RCE

Advantech WebAccess 8.3.2 and below is vulnerable to a stack buffer overflow vulnerability. A remote authenticated attacker could potentially exploit this vulnerability by sending a crafted HTTP request to broadweb/system/opcImg.asp.

EPSS: 21.54%
6.1 CVSS
CVE-2018-15703

Advantech WebAccess 8.3.2 and below is vulnerable to multiple reflected cross site scripting vulnerabilities. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim to supply malicious HTML or JavaScript code to WebAccess, which is then reflected back to the victim and executed by the web browser.

EPSS: 0.88%
9.8 CVSS
CVE-2018-8845

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, a heap-based buffer overflow vulnerability has been identified, which may allow an attacker to execute arbitrary code.

EPSS: 5.68%