Read the docs
TI-2023-01357 Aliases CVE-2023-1437GHSA-qv79-48vx-52fw

Memory corruption in Advantech WebAccess/SCADA

Priority MEDIUM 47CWE-822Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-822 and the CVSS impact.

Summary

All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute commands and overwrite files.

Why it matters now

EPSS 0.02798 86th percentileScored 2026-11-07
Fix Fixed WebAccess/SCADA (Advantech): 9.1.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdvantechWebAccess/SCADAbefore 9.1.49.1.4Patch availableCNA
  • WebAccess/SCADA VendorAdvantech Affected before 9.1.4 Fixed in 9.1.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:advantech:webaccess\/scada:*:*:*:*:*:*:*:*before 9.1.4VulnerableAdvantech
  • cpe:2.3:a:advantech:webaccess\/scada:*:*:*:*:*:*:*:* Versions before 9.1.4 Vulnerable ·Advantech

Remediation

  • Fix · CNA WebAccess/SCADA (Advantech) Fixed in 9.1.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-1437
  2. 2026-10-03 Alias added: GHSA-qv79-48vx-52fw

References

Advisory 1

  • TI-2019-04573 WebAccess/SCADA, Version 8.3. CVSS 3.0CRITICAL 9.8
  • TI-2021-12552 Stack-based buffer overflow in WebAccess/SCADA CVSS 3.1CRITICAL 9.8
  • TI-2019-04577 WebAccess/SCADA, Version 8.3. CVSS 3.0CRITICAL 9.8
  • TI-2023-15822 Code injection in Advantech WebAccess/SCADA CVSS 3.1CRITICAL 9.8
  • TI-2023-15909 Unrestricted file upload in Advantech WebAccess/SCADA CVSS 3.1CRITICAL 9.8
  • TI-2025-13544 Advantech WebAccess/SCADA Unrestricted Upload of File with Dangerous Type CVSS 4.0HIGH 8.7
See all 28 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences