SCADA Vulnerabilities & Exposures (SVE)

CRITIFENCE® SCADA Vulnerabilities and Exposures Database (SVE)

[SVE-828710095] Advantech WebAccess/SCADA

Date Type Platform Author EDB-ID CVE-ID OSVDB-ID Download App SIS Signature
2018-01-23OtherAdvantech rgod working with Trend Micro’s Zero Day Initiative reported these vulnerabilities to ICS-CERT.N/ACVE-2018-5445 CVE-2018-5443 N/AN/AN/A

Source

						
							
								
#
# Advantech WebAccess/SCADA
#


### VULNERABLE VENDOR
Advantech 


### VULNERABLE PRODUCT
WebAccess/SCADA 


### RESEARCHER
rgod working with Trend Micro’s Zero Day Initiative reported these vulnerabilities to ICS-CERT.


### AFFECTED PRODUCTS
The following versions of WebAccess/SCADA, a SCADA software platform, are affected:

WebAccess/SCADA versions prior to V8.2_20170817



### IMPACT
Successful exploitation of these vulnerabilities could allow sensitive information to be disclosed from the target or database without authentication.


### VULNERABILITY OVERVIEW
IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22
An attacker has read access to files within the directory structure of the target device.
CVE-2018-5445 has been assigned to this vulnerability.
A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)


IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN SQL COMMAND ('SQL INJECTION') CWE-89
WebAccess/SCADA does not properly sanitize its inputs for SQL commands.
CVE-2018-5443 has been assigned to this vulnerability.
A CVSS v3 base score of 5.3 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)





### BACKGROUND
Critical Infrastructure Sectors: Critical Manufacturing, Energy, Water and Wastewater Systems
Countries/Areas Deployed: East Asia, United States, Europe
Company Headquarters Location: Taiwan




### MITIGATION

Advantech has released a version 8.3.0 of WebAccess/SCADA to address the reported vulnerabilities. Users can download the latest version of WebAccess/SCADA at the following location (registration required):

http://www.advantech.com/industrial-automation/webaccess/download