Advantech WebAccess

Risk Summary

Successful exploitation of these vulnerabilities could allow an attacker to gain remote code execution.

CVEs (2)

Remediations

• Advantech has released Version 9.1.1 to address the stack-based buffer overflow vulnerability.
• In order to address the heap-based buffer overflow vulnerability, Advantech recommends users directly add the remote access code to avoid being attacked by unknown requests. This is the remote access code established during installation of the Advantech WebAccess SCADA software (SCADA node, project node, or OPC Service) on the OPC Server computer. The access code you enter here must match the remote access code established during installation on the OPC Server. This prevents unauthorized users from accessing the OPC Server data using the Advantech WebAccess SCADA OPC Service.
• If you have forgotten the remote access code using during software installation on the OPC Server node, you have two options:
• Re-install the Advantech WebAccess SCADA software on the OPC Server node to change it and edit it to match in your database.
• Edit the BWSERVER.INI file on the OPC Server node and edit it to match in your database using UPDATE.

Affected Vendors

Affected Products (1)

Affected Sectors

Critical Manufacturing, Energy, Water and Wastewater Systems