Advantech released a new version to mitigate command injection, stack-based buffer overflow, and improper access control vulnerabilities in its WebAccess/SCADA, according to a report with NCCIC.
Successful exploitation of these vulnerabilities, discovered by Mat Powell and Natnael Samson (@NattiSamson) working with Trend Micro’s Zero Day Initiative (ZDI), may cause a denial of service and allow remote code execution.
A SCADA software platform, WebAccess/SCADA Versions 8.3.5 and prior suffer from the remotely exploitable vulnerabilities.
In one vulnerability, multiple command injection issues, caused by a lack of proper validation of user-supplied data, may allow remote code execution.
CVE-2019-6552 is the case number assigned to these vulnerabilities, which has a CVSS v3 base score of 9.8.
In addition, multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code execution.
CVE-2019-6550 is the case number assigned to these vulnerabilities, which has a CVSS v3 base score of 9.8.
Also, an improper access control vulnerability may allow an attacker to cause a denial-of-service condition.
CVE-2019-6554 is the case number assigned to this vulnerability, which has a CVSS v3 base score of 7.5.
The product sees use mainly in the critical manufacturing, energy, and water and wastewater systems sectors. The product also sees action in East Asia, United States, and Europe.
No known public exploits specifically target these vulnerabilities. However, an attacker with low skill level could leverage the vulnerabilities.
Taiwan-based Advantech released Version 8.4.0 of WebAccess/SCADA to address the reported vulnerabilities. Users can download the latest version of WebAccess/SCADA (registration required).