CVE-2023-2866
Assigner: icscert
Published: 2023-06-07T20:12:46.824Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: WebAccess/SCADA
vendor: Advantech
versions: status: affected
version: 8.4.5
credits: type: finder
user: 00000000-0000-4000-9000-000000000000
value: Marlon Luis Petry reported this vulnerability to CISA.
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server. </span>


value: 
If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server. 


metrics: cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-351
description: CWE-351 Insufficient Type Distinction
type: CWE
solutions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">Advantech released a new </span><a target="_blank" rel="nofollow" href="https://www.advantech.com/en/support/details/installation?id=1-MS9MJV">version V9.1.4</a><span style="background-color: rgb(255, 255, 255);">&nbsp;to address the problem by not including these files.</span>

<br>
value: 
Advantech released a new  version V9.1.4 https://www.advantech.com/en/support/details/installation  to address the problem by not including these files.



source: discovery: EXTERNAL
title: Advantech WebAccess Insufficient Type Distinction
workarounds: supportingMedia: base64: no
type: text/html
value: 
<p>Advantech recommends users locate and delete the “WADashboardSetup.msi” file to avoid this issue.</p><p>If
 users wish to remedy this problem in version 8.4.5, they can uninstall 
"WebAccess Dashboard" from the control panel. Delete all the files:</p><p>\Inetpub\wwwroot\broadweb\WADashboard</p><p>\WebAccess\Node\WADashboardSetup.msi</p>

<br>
value: Advantech recommends users locate and delete the “WADashboardSetup.msi” file to avoid this issue.

If
 users wish to remedy this problem in version 8.4.5, they can uninstall 
"WebAccess Dashboard" from the control panel. Delete all the files:

\Inetpub\wwwroot\broadweb\WADashboard

\WebAccess\Node\WADashboardSetup.msi





x_generator: engine: Vulnogram 0.1.0-dev