CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2019-3953
https://notcve.org/view.php?id=CVE-2019-3953
Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 10012 RPC call. Un desbordamiento de búfer en la región stack de la memoria en WebAccess/SCADA de Advantech versión 8.4.0, permite que un atacante remoto no autenticado, ejecute un código arbitrario mediante el envío de una llamada RPC IOCTL 10012 creada. • https://www.tenable.com/security/research/tra-2019-17 https://www.tenable.com/security/research/tra-2019-28 • CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-3941
https://notcve.org/view.php?id=CVE-2019-3941
Advantech WebAccess 8.3.4 allows unauthenticated, remote attackers to delete arbitrary files via IOCTL 10005 RPC. Advantech WebAccess en la versión 8.3.4, permite a los atacantes remotos no autenticados eliminar archivos arbitrarios mediante IOCTL 10005 RPC. • http://www.securityfocus.com/bid/107847 https://www.tenable.com/security/research/tra-2019-15 • CWE-306: Missing Authentication for Critical Function •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-3940
https://notcve.org/view.php?id=CVE-2019-3940
Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call. An unauthenticated, remote attacker can use this vulnerability to execute arbitrary code. Advantech WebAccess versión 8.3.4 es vulnerable a ataques de carga de archivos por medio de una llamada RPC no autenticada. Un atacante remoto no autenticado puede usar esta vulnerabilidad para ejecutar código arbitrario. • http://www.securityfocus.com/bid/107847 https://www.tenable.com/security/research/tra-2019-15 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.8EPSS: 5%CPEs: 1EXPL: 0CVE-2019-6550 – Advantech WebAccess Node makensis Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-6550
Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code execution. Advantech WebAccess/SCADA, en versiones 8.3.5 y anteriores. Múltiples vulnerabilidades de desbordamiento de búfer basado en pila, provocadas por la falta de una validación correcta de la longitud de los datos proporcionados, podrían permitir una ejecución remota de código. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess Node. • https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01 https://www.zerodayinitiative.com/advisories/ZDI-19-585 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2019-6552 – Advantech WebAccess Node bwrunmie Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2019-6552
Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, may allow remote code execution. Advantech WebAccess/SCADA, en versiones 8.3.5 y anteriores. Múltiples vulnerabilidades de inyección de comandos, provocadas por la falta de una validación correcta de la longitud de los datos proporcionados, podrían permitir una ejecución remota de código. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess Node. • https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •