SB2019091908 - Multiple vulnerabilities in Advantech WebAccess

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Code Injection (CVE-ID: CVE-2019-13558)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper input validation. A remote attacker can send a specially crafted request and execute arbitrary code, filter data or crash the system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) Command Injection (CVE-ID: CVE-2019-13552)

3) Stack-based buffer overflow (CVE-ID: CVE-2019-13556)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a lack of proper validation of the length of user-supplied data. A remote authenticated attacker can trigger stack-based buffer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

4) Improper Authorization (CVE-ID: CVE-2019-13550)

Remediation

Install update from vendor's website.

References

• https://ics-cert.us-cert.gov/advisories/icsa-19-260-01
• https://www.us-cert.gov/ics/advisories/icsa-19-260-01