Detections
Analytics
Advantech WebAccess < 7.2-2014.06.06 Multiple Vulnerabilities
high Nessus Network Monitor Plugin ID 9958
Synopsis
The detected version of Advantech WebAccess may be affected by multiple attack vectors.Description
The installed version of Advantech WebAccess is prior to 7.2-2014.06.06 and is affected by the following vulnerabilities :- Multiple stack overflows can be triggered with overly long strings to the 'ProjectName', 'SetParameter', 'NodeName', 'CCDParameter', 'SetColor', 'AlarmImage', 'GetParameter', 'GetColor', 'ServerResponse', 'SetBaud', and 'IPAddress' parameters of the 'webvact.ocx', 'dvs.ocx', and 'webdact.ocx' ActiveX files. (CVE-2014-2364)
- An unspecified flaw exists in WebAccess that allows an attacker to create or delete arbitrary files. (CVE-2014-2365)
- The 'pAdminPg.asp' component includes the password of the specified account in the underlying HTML. (CVE-2014-2366)
- The 'ChkCookie' subroutine in the 'broadweb\include\gChkCook.asp' ActiveX control can be abused to bypass authentication. (CVE-2014-2367)
- The 'BrowseFolder' method of the 'bwocxrun' ActiveX control allows navigation from the Internet to a local file. (CVE-2014-2368)
Solution
Upgrade to Advantech WebAccess version 7.2-2014.06.06 or later.See Also
Plugin Details
Severity: High
ID: 9958
Family: SCADA
Published: 2/14/2017
Updated: 3/6/2019
Nessus ID: 73643
Risk Information
VPR
Risk Factor: High
Score: 8.8
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS v3
Risk Factor: High
Base Score: 7.3
Temporal Score: 7
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:advantech:advantech_webaccess
Patch Publication Date: 6/6/2014
Vulnerability Publication Date: 6/6/2014
Exploitable With
Metasploit (Advantech WebAccess dvs.ocx GetColor Buffer Overflow)
Reference Information
CVE: CVE-2014-2364, CVE-2014-2365, CVE-2014-2366, CVE-2014-2367, CVE-2014-2368