RCE in Advantech Advantech_webaccess
CVE-2014-0773
The BWOCXRUN.BwocxrunCtrl.1 control contains a method named “CreateProcess.” This method contains validation to ensure an attacker cannot run arbitrary command lines. After validation, the values supplied in the HTML are passed to the W…
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.004 (59.9th percentile) — read the EPSS interpretation.
Affected products
- Advantech Advantech_webaccess — versions 5.0, 6.0, 7.0
- Advantech Webaccess — versions 7.2, 0
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov
- 66740 (vdb-entry, x_refsource_BID)
- ics-cert@hq.dhs.gov
- af854a3a-2127-422b-91ae-364da2661108 (US Government Resource)