In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the operating system (including system files), inject code into an XLS file, and modify the file extension, which could lead to arbitrary code execution.
References
| Link | Resource |
|---|---|
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-01 | Mitigation Third Party Advisory US Government Resource |
| https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-01 | Mitigation Third Party Advisory US Government Resource |
Configurations
History
21 Nov 2024, 08:03
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-01 - Mitigation, Third Party Advisory, US Government Resource | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.2 |
12 Jun 2023, 16:55
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-01 - Mitigation, Third Party Advisory, US Government Resource | |
| First Time |
Advantech webaccess\/scada
Advantech |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
| CPE | cpe:2.3:a:advantech:webaccess\/scada:*:*:*:*:*:*:*:* |
06 Jun 2023, 00:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-06-06 00:15
Updated : 2024-11-21 08:03
NVD link : CVE-2023-32540
Mitre link : CVE-2023-32540
CVE.ORG link : CVE-2023-32540
JSON object : View
Products Affected
advantech
- webaccess\/scada
CWE
CWE-94
Improper Control of Generation of Code ('Code Injection')