Read the docs

Advantech

Records434All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical118CVSS 9.0–10.0
CVSS high195CVSS 7.0–8.9

Exploited now

Advantech records in CISA KEV

No Advantech vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Webaccess 103 records HIGH Advantech Webaccess 44 records HIGH R-seenet 40 records HIGH Iview 37 records HIGH Webaccess/scada 29 records MEDIUM Eki-6333ac-1gpo Firmware 20 records MEDIUM Eki-6333ac-2g Firmware 20 records MEDIUM Eki-6333ac-2gd Firmware 20 records MEDIUM

Records

20 records in Webaccess/nms · all components

TI-2020-08531 CVE-2020-10619 · GHSA-wpmh-wc89-xwhj

Path traversal in WebAccess/NMS

Priority MEDIUM 55

An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.14327 Published 2020-04-09 Fixed in 3.0.2 CWE-23
TI-2018-06387 CVE-2018-8845 · GHSA-r2p8-8cx3-42qq

Heap-based buffer overflow in Advantech WebAccess

Priority MEDIUM 51

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and pri…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05569 Published 2018-05-15 No fix listed CWE-122
TI-2018-07478 CVE-2018-10589 · GHSA-92hq-qvmc-rcj7

Path traversal in Advantech WebAccess

Priority MEDIUM 49

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and pri…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.03941 Published 2018-05-15 No fix listed CWE-22
TI-2018-05408 CVE-2018-7499 · GHSA-whww-465v-hrfr

Stack-based buffer overflow in Advantech WebAccess

Priority MEDIUM 48

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and pri…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03719 Published 2018-05-15 No fix listed CWE-121
TI-2018-05414 CVE-2018-7505 · GHSA-mxm8-g5h2-w69j

Access control flaw in Advantech WebAccess

Priority MEDIUM 47

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and pri…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02791 Published 2018-05-15 No fix listed CWE-264
TI-2018-05406 CVE-2018-7497 · GHSA-f2h7-p6gx-hh2p

NULL pointer dereference in Advantech WebAccess

Priority MEDIUM 47

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and pri…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.02791 Published 2018-05-15 No fix listed CWE-822
TI-2020-08543 CVE-2020-10631 · GHSA-672q-2qcf-wwfp

Path traversal in WebAccess/NMS

Priority MEDIUM 45

An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2) control.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01484 Published 2020-04-09 Fixed in 3.0.2 CWE-23
TI-2020-08515 CVE-2020-10603 · GHSA-5mwx-jr2x-3wj7

OS command injection in WebAccess/NMS

Priority MEDIUM 41

WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject system commands remotely.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01221 Published 2020-04-09 Fixed in 3.0.2 CWE-78
TI-2018-05412 CVE-2018-7503 · GHSA-wp7j-7rh2-gfqr

Path traversal in Advantech WebAccess

Priority LOW 38

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and pri…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.0245 Published 2018-05-15 No fix listed CWE-22
TI-2018-05404 CVE-2018-7495 · GHSA-g8c4-9gqr-q3cf

Path traversal in Advantech WebAccess

Priority LOW 37

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and pri…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02117 Published 2018-05-15 No fix listed CWE-73
TI-2018-05410 CVE-2018-7501 · GHSA-j574-68wv-r2pg

SQL injection in Advantech WebAccess

Priority LOW 36

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and pri…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.01586 Published 2018-05-15 No fix listed CWE-89
TI-2020-08541 CVE-2020-10629 · GHSA-f4q7-86mf-q9v2

XML external entity injection in WebAccess/NMS

Priority LOW 35

WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01231 Published 2020-04-09 Fixed in 3.0.2 CWE-611
TI-2020-08529 CVE-2020-10617 · GHSA-8h9g-g25c-xm92

SQL injection in WebAccess/NMS

Priority LOW 35

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01263 Published 2020-04-09 Fixed in 3.0.2 CWE-89
TI-2018-06383 CVE-2018-8841 · GHSA-5rwg-3977-9qwq

Improper privilege management in Advantech WebAccess

Priority LOW 34

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and pri…

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.0035 Published 2018-05-15 No fix listed CWE-269
TI-2020-08535 CVE-2020-10623 · GHSA-5cqh-cf3j-whp5

SQL injection in WebAccess/NMS

Priority LOW 31

Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00922 Published 2020-04-09 Fixed in 3.0.2 CWE-89
TI-2018-07480 CVE-2018-10591 · GHSA-qgcv-4qmw-5vxg

Origin validation error in Advantech WebAccess

Priority LOW 28

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and pri…

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.00616 Published 2018-05-15 No fix listed CWE-346
TI-2021-12560 CVE-2021-32951 · GHSA-9rgm-96q6-gc9m

Advantech WebAccess/NMS Improper Authentication

Priority LOW 26

WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an improper authentication vulnerability, which may allow unauthorized users to view resources monitored and controlled by the WebAccess/NMS, as well as IP addresses…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00948 Published 2021-10-27 Fixed in v3.0.3_Build6299 CWE-287
Open these records in search →