What is CVE-2020-12022?

CVE-2020-12022 is a critical-severity vulnerability in Advantech Webaccess, classified under Improper Validation of Array Index. CVSS score: 9.8/10. Published 2020-05-08.

How severe is CVE-2020-12022?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Advantech Webaccess

CVE-2020-12022

Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially crafted input into memory where it can be executed.

EPSS: 0.017 (74.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Advantech Webaccess — versions 9.0.0
N/a Advantech Webaccess Node — versions WebAccess Node Version 8.4.4 and prior, WebAccess Node Version 9.0.0

Weakness classification (CWE)

CWE-129 — Improper Validation of Array Index

References

ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)
ics-cert@hq.dhs.gov (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-12022?: CVE-2020-12022 is a critical-severity vulnerability in Advantech Webaccess, classified under Improper Validation of Array Index. CVSS score: 9.8/10. Published 2020-05-08.
How severe is CVE-2020-12022?: Critical severity. CVSS v3 base score is 9.8 out of 10.