Advantech
Page 2 of 4 — Advantech CVEs from a corpus of 388, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2866 | High | 7.3 | 2023-06-07 | If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used… |
CVE-2023-32628 | High | 7.2 | 2023-06-06 | In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of… |
CVE-2023-32540 | High | 7.2 | 2023-06-06 | In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the o… |
CVE-2023-22450 | High | 7.2 | 2023-06-06 | In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an ASP script file to a… |
CVE-2023-2575 | High | 8.8 | 2023-05-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stack-based Buffer Overflow vulnerability, which can be triggered by authenticate… |
CVE-2023-2574 | High | 8.8 | 2023-05-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the device name input field, which can be tri… |
CVE-2023-2573 | High | 8.8 | 2023-05-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be trig… |
CVE-2022-3387 | Medium | 6.5 | 2022-10-27 | Advantech R-SeeNet Versions 2.4.19 and prior are vulnerable to path traversal attacks. An unauthorized attacker could remotely exploit vulnerable PHP code to… |
CVE-2022-3386 | Critical | 9.8 | 2022-10-27 | Advantech R-SeeNet Versions 2.4.17 and prior are vulnerable to a stack-based buffer overflow. An unauthorized attacker can use an outsized filename to overflo… |
CVE-2022-3385 | Critical | 9.8 | 2022-10-27 | Advantech R-SeeNet Versions 2.4.17 and prior are vulnerable to a stack-based buffer overflow. An unauthorized attacker can remotely overflow the stack buffer… |
CVE-2022-3323 | High | 7.5 | 2022-09-27 | An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 808… |
CVE-2022-2143 | Critical | 9.8 | 2022-07-22 | The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. |
CVE-2022-2142 | High | 8.1 | 2022-07-22 | The affected product is vulnerable to a SQL injection with high attack complexity, which may allow an unauthorized attacker to disclose information. |
CVE-2022-2139 | Medium | 6.5 | 2022-07-22 | The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and execute arbitrary code. |
CVE-2022-2138 | High | 8.2 | 2022-07-22 | The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute arbitrary code, resu… |
CVE-2022-2137 | Medium | 4.9 | 2022-07-22 | The affected product is vulnerable to two SQL injections that require high privileges for exploitation and may allow an unauthorized attacker to disclose infor… |
CVE-2022-2136 | High | 8.8 | 2022-07-22 | The affected product is vulnerable to multiple SQL injections that require low privileges for exploitation and may allow an unauthorized attacker to disclose i… |
CVE-2022-2135 | High | 7.5 | 2022-07-22 | The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information. |
CVE-2022-22987 | Critical | 9.8 | 2022-02-04 | The affected product has a hardcoded private key available inside the project folder, which may allow an attacker to achieve Web Server login and perform furth… |
CVE-2021-40397 | High | 7.8 | 2022-01-28 | A privilege escalation vulnerability exists in the installation of Advantech WISE-PaaS/OTA Server 3.0.9. A specially-crafted file can be replaced in the system… |
CVE-2021-40396 | High | 8.8 | 2022-01-28 | A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iService 1.1.7. A specially-crafted file can be replaced in the system to… |
CVE-2021-40389 | High | 8.8 | 2022-01-28 | A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. A specially-crafted file can be replaced in the syste… |
CVE-2021-40388 | High | 8.8 | 2022-01-28 | A privilege escalation vulnerability exists in Advantech SQ Manager Server 1.0.6. A specially-crafted file can be replaced in the system to escalate privileges… |
CVE-2021-21937 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘host_alt_filter’… |
CVE-2021-21936 | High | 8.8 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘health_alt_filte… |
CVE-2021-21935 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘host_alt_filter2… |
CVE-2021-21934 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘imei_filter’ parameter. This c… |
CVE-2021-21933 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘esn_filter’ parameter. This ca… |
CVE-2021-21932 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this at ‘name_filter’ parameter. This c… |
CVE-2021-21931 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at‘ stat_filter’ parameter to trigger this vulnera… |
CVE-2021-21930 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘sn_filter’ parameter to trigger this vulnerabi… |
CVE-2021-21929 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘prod_filter’ parameter to trigger this vulnera… |
CVE-2021-21928 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests at ‘mac_filter’ parameter to trigger this vulnerab… |
CVE-2021-21927 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done… |
CVE-2021-21926 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done… |
CVE-2021-21925 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done… |
CVE-2021-21924 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done… |
CVE-2021-21923 | Medium | 4.9 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘company_filter’… |
CVE-2021-21922 | Medium | 6.5 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘username_filter’… |
CVE-2021-21921 | Medium | 4.9 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘name_filter’ par… |
CVE-2021-21920 | Medium | 4.9 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘surname_filter’… |
CVE-2021-21919 | Medium | 4.9 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ord’ parameter. H… |
CVE-2021-21918 | Medium | 4.9 | 2021-12-22 | A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘name_filter’ par… |
CVE-2021-21917 | High | 8.8 | 2021-12-22 | An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted HTTP request at '‘… |
CVE-2021-21916 | High | 8.8 | 2021-12-22 | An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted HTTP request at 'd… |
CVE-2021-21915 | High | 8.8 | 2021-12-22 | An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-crafted HTTP request at ‘c… |
CVE-2021-21912 | High | 7.8 | 2021-12-22 | A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-c… |
CVE-2021-21911 | High | 7.8 | 2021-12-22 | A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-c… |
CVE-2021-21910 | High | 7.8 | 2021-12-22 | A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021). A specially-c… |
CVE-2021-42703 | Medium | 5.4 | 2021-11-15 | This vulnerability could allow an attacker to send malicious Javascript code resulting in hijacking of the user’s cookie/session tokens, redirecting the user t… |
CVE-2021-42706 | High | 7.8 | 2021-11-15 | This vulnerability could allow an attacker to disclose information and execute arbitrary code on affected installations of WebAccess/MHI Designer |
CVE-2021-32951 | Medium | 5.3 | 2021-10-27 | WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an improper authentication vulnerability, which may allow unauthorized users to view resources monitored… |
CVE-2021-38389 | Critical | 9.8 | 2021-10-18 | Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code. |
CVE-2021-33023 | Critical | 9.8 | 2021-10-18 | Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code. |
CVE-2021-38431 | Medium | 4.3 | 2021-10-15 | An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users. |
CVE-2021-38408 | Critical | 9.8 | 2021-09-09 | A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the length of user-supplied… |
CVE-2021-32943 | Critical | 9.8 | 2021-08-10 | The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code on the WebAccess/SCADA (Web… |
CVE-2021-22676 | Medium | 6.1 | 2021-08-10 | UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting (XSS), which could allow an attacker to send malicious JavaScript code. This coul… |
CVE-2021-22674 | Medium | 6.5 | 2021-08-10 | The affected product is vulnerable to a relative path traversal condition, which may allow an attacker access to unauthorized files and directories on the WebA… |
CVE-2021-21805 | Critical | 9.8 | 2021-08-05 | An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request… |
CVE-2021-21804 | Critical | 9.8 | 2021-07-16 | A local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP… |
CVE-2021-21803 | Medium | 6.1 | 2021-07-16 | This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attack… |
CVE-2021-21802 | Medium | 6.1 | 2021-07-16 | This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attack… |
CVE-2021-21801 | Medium | 6.1 | 2021-07-16 | This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attack… |
CVE-2021-21800 | Medium | 6.1 | 2021-07-16 | Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a specially c… |
CVE-2021-21799 | Medium | 6.1 | 2021-07-16 | Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). If a user visits a speciall… |
CVE-2021-33004 | High | 7.8 | 2021-06-24 | The affected product is vulnerable to memory corruption condition due to lack of proper validation of user supplied files, which may allow an attacker to execu… |
CVE-2021-33002 | High | 7.8 | 2021-06-24 | Opening a maliciously crafted project file may cause an out-of-bounds write, which may allow an attacker to execute arbitrary code. User interaction is require… |
CVE-2021-33000 | High | 7.8 | 2021-06-24 | Parsing a maliciously crafted project file may cause a heap-based buffer overflow, which may allow an attacker to perform arbitrary code execution. User intera… |
CVE-2021-32956 | Medium | 6.1 | 2021-06-18 | Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to redirection, which may allow an attacker to send a maliciously crafted URL that could resul… |
CVE-2021-32954 | Medium | 6.5 | 2021-06-18 | Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to a directory traversal, which may allow an attacker to remotely read arbitrary files on the… |
CVE-2021-32932 | High | 7.5 | 2021-06-11 | The affected product is vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information on the iView (versions prior to v5.7.03… |
CVE-2021-32930 | Critical | 9.8 | 2021-06-11 | The affected product’s configuration is vulnerable due to missing authentication, which may allow an attacker to change configurations and execute arbitrary co… |
CVE-2021-34540 | Medium | 6.1 | 2021-06-11 | Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard. |
CVE-2021-27437 | Critical | 9.1 | 2021-05-07 | The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded administrator username and… |
CVE-2021-22669 | High | 8.8 | 2021-04-26 | Incorrect permissions are set to default on the ‘Project Management’ page of WebAccess/SCADA portal of WebAccess/SCADA Versions 9.0.1 and prior, which may allo… |
CVE-2021-27436 | Medium | 6.1 | 2021-03-18 | WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting… |
CVE-2019-18235 | Critical | 9.8 | 2021-03-17 | Advantech Spectre RT ERT351 Versions 5.1.3 and prior has insufficient login authentication parameters required for the web application may allow an attacker to… |
CVE-2019-18233 | Medium | 6.1 | 2021-03-17 | In Advantech Spectre RT Industrial Routers ERT351 5.1.3 and prior, the affected product does not neutralize special characters in the error response, allowing… |
CVE-2019-18231 | High | 7.5 | 2021-03-17 | Advantech Spectre RT ERT351 Versions 5.1.3 and prior logins and passwords are transmitted in clear text form, which may allow an attacker to intercept the requ… |
CVE-2020-13554 | High | 7.8 | 2021-03-03 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In webvrpcs Run K… |
CVE-2021-22667 | Critical | 9.8 | 2021-02-24 | BB-ESWGP506-2SFP-T versions 1.01.09 and prior is vulnerable due to the use of hard-coded credentials, which may allow an attacker to gain unauthorized access a… |
CVE-2020-25161 | High | 8.8 | 2021-02-23 | The WADashboard component of WebAccess/SCADA Versions 9.0 and prior may allow an attacker to control or influence a path used in an operation on the filesystem… |
CVE-2020-13555 | High | 8.8 | 2021-02-17 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In COM Server App… |
CVE-2020-13553 | High | 8.8 | 2021-02-17 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In webvrpcs Run K… |
CVE-2020-13552 | High | 8.8 | 2021-02-17 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege esca… |
CVE-2020-13551 | High | 8.8 | 2021-02-17 | An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege esca… |
CVE-2020-13550 | High | 7.7 | 2021-02-17 | A local file inclusion vulnerability exists in the installation functionality of Advantech WebAccess/SCADA 9.0.1. A specially crafted application can lead to i… |
CVE-2021-22658 | Critical | 9.8 | 2021-02-11 | Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Administrator'. |
CVE-2021-22656 | High | 7.5 | 2021-02-11 | Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files. |
CVE-2021-22654 | High | 7.5 | 2021-02-11 | Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information. |
CVE-2021-22652 | Critical | 9.8 | 2021-02-11 | Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the c… |
CVE-2020-25157 | High | 7.5 | 2020-10-20 | The R-SeeNet webpage (1.5.1 through 2.4.10) suffers from SQL injection, which allows a remote attacker to invoke queries on the database and retrieve sensitive… |
CVE-2020-16202 | High | 7.8 | 2020-09-22 | WebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific services, which may allow code execution with system… |
CVE-2020-16245 | Critical | 9.8 | 2020-08-25 | Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that could allow an attacker to create/download a… |
CVE-2020-16229 | High | 7.8 | 2020-08-06 | Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may c… |
CVE-2020-16217 | High | 7.8 | 2020-08-06 | Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. A double free vulnerability caused by processing specially crafted project files may allow remot… |
CVE-2020-16215 | High | 7.8 | 2020-08-06 | Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may c… |
CVE-2020-16213 | High | 7.8 | 2020-08-06 | Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. Processing specially crafted project files lacking proper validation of user supplied data may c… |
CVE-2020-16211 | Medium | 5.5 | 2020-08-06 | Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. An out-of-bounds read vulnerability may be exploited by processing specially crafted project fil… |