CVSS: 9.8EPSS: 11%CPEs: 1EXPL: 0CVE-2020-12019 – Advantech WebAccess Node Incorrect Permission Assignment Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2020-12019
WebAccess Node Version 8.4.4 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code. WebAccess Node versión 8.4.4 y anteriores, es vulnerable a un desbordamiento de búfer en la región stack de la memoria, que puede permitir a un atacante ejecutar código arbitrario remotamente This vulnerability allows local attackers to escalate privileges on affected installations of Advantech WebAccess Node. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of the PostgreSQL database. The issue results from incorrect permissions set on a resource used by the service. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of SYSTEM. • https://www.us-cert.gov/ics/advisories/icsa-20-161-01 • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 11%CPEs: 2EXPL: 0CVE-2020-10638 – Advantech WebAccess/SCADA BwBacNetJ Heap-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-10638
Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution. Advantech WebAccess Node, versiones 8.4.4 y anteriores, versión 9.0.0. Se presentan múltiples vulnerabilidades de desbordamiento del búfer en la región heap de la memoria causada por una falta de comprobación apropiada de la longitud de los datos suministrados por el usuario, que puede permitir una ejecución de código remota. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/SCADA. • https://www.us-cert.gov/ics/advisories/icsa-20-128-01 https://www.zerodayinitiative.com/advisories/ZDI-20-593 https://www.zerodayinitiative.com/advisories/ZDI-20-599 https://www.zerodayinitiative.com/advisories/ZDI-20-600 https://www.zerodayinitiative.com/advisories/ZDI-20-603 https://www.zerodayinitiative.com/advisories/ZDI-20-616 https://www.zerodayinitiative.com/advisories/ZDI-20-621 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 9.8EPSS: 9%CPEs: 2EXPL: 0CVE-2020-12002 – Advantech WebAccess/SCADA BwBacNetJ Stack-based Buffer Overflow Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-12002
Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution. Advantech WebAccess Node, versiones 8.4.4 y anteriores, versión 9.0.0. Se presentan múltiples vulnerabilidades de desbordamiento del búfer en la región stack de la memoria causada por una falta de comprobación apropiada de la longitud de los datos suministrados por el usuario, que puede permitir una ejecución de código remota. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/SCADA. • https://www.us-cert.gov/ics/advisories/icsa-20-128-01 https://www.zerodayinitiative.com/advisories/ZDI-20-590 https://www.zerodayinitiative.com/advisories/ZDI-20-591 https://www.zerodayinitiative.com/advisories/ZDI-20-592 https://www.zerodayinitiative.com/advisories/ZDI-20-619 https://www.zerodayinitiative.com/advisories/ZDI-20-622 https://www.zerodayinitiative.com/advisories/ZDI-20-624 https://www.zerodayinitiative.com/advisories/ZDI-20-625 https://www.zerodayinitiative.com/advisories/ZDI-20&# • CWE-121: Stack-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 0CVE-2020-12018 – Advantech WebAccess/SCADA DrawSrv IOCTL 0x00002722 Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2020-12018
Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An out-of-bounds vulnerability exists that may allow access to unauthorized data. Advantech WebAccess Node, versiones 8.4.4 y anteriores, versión 9.0.0. Se presenta una vulnerabilidad de lectura fuera de límites que puede permitir el acceso a datos no autorizados. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/SCADA. • https://www.us-cert.gov/ics/advisories/icsa-20-128-01 https://www.zerodayinitiative.com/advisories/ZDI-20-628 • CWE-125: Out-of-bounds Read •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-12022 – Advantech WebAccess/SCADA DATACORE IOCTL 0x0000521e Improper Validation of Array Index Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2020-12022
Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially crafted input into memory where it can be executed. Advantech WebAccess Node, versiones 8.4.4 y anteriores, versión 9.0.0. Se presenta una vulnerabilidad de comprobación inapropiada que podría permitir a un atacante inyectar información especialmente diseñada dentro de la memoria donde pueda ser ejecutada. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/SCADA. • https://www.us-cert.gov/ics/advisories/icsa-20-128-01 https://www.zerodayinitiative.com/advisories/ZDI-20-598 • CWE-129: Improper Validation of Array Index •