Sign-up

ID

VAR-201903-1775


TITLE

(0Day) Advantech WebAccess Node Product Installation File Access Control Modification Privilege Escalation Vulnerability

Trust: 0.7

sources: ZDI: ZDI-19-257

DESCRIPTION

This vulnerability allows local attackers to escalate privileges on vulnerable installations of Advantech WebAccess Node. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the access control that is set and modified during the installation of the product. The product installation weakens existing access control restrictions of current system files, then sets weak access control restrictions on new files. An attacker can leverage this vulnerability to escalate privileges to the level of an administrator.

Trust: 0.7

sources: ZDI: ZDI-19-257

AFFECTED PRODUCTS

vendor:advantechmodel:webaccessscope: - version: -

Trust: 0.7

sources: ZDI: ZDI-19-257

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI: ZDI-19-257
value: HIGH

Trust: 0.7

ZDI: ZDI-19-257
baseSeverity: HIGH
baseScore: 7.8
vectorString: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: ZDI: ZDI-19-257

EXTERNAL IDS

db:ZDI_CANid:ZDI-CAN-7411

Trust: 0.7

db:ZDIid:ZDI-19-257

Trust: 0.7

sources: ZDI: ZDI-19-257

CREDITS

Fritz Sands of Trend Micro Zero Day Initiative

Trust: 0.7

sources: ZDI: ZDI-19-257

SOURCES

db:ZDIid:ZDI-19-257

LAST UPDATE DATE

2022-05-17T01:52:31.485000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-19-257date:2019-05-30T00:00:00

SOURCES RELEASE DATE

db:ZDIid:ZDI-19-257date:2019-03-07T00:00:00