Sign-up

ID

VAR-202005-0008


CVE

CVE-2020-10638


TITLE

Advantech WebAccess/SCADA ViewSrv IOCTL 0x00002723 Heap-based Buffer Overflow Remote Code Execution Vulnerability

Trust: 0.7

sources: ZDI: ZDI-20-593

DESCRIPTION

Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/SCADA. Authentication is not required to exploit this vulnerability.The specific flaw exists within the implementation of IOCTL 0x0000791d in DATACORE.exe. An attacker can leverage this vulnerability to execute code in the context of Administrator. Advantech WebAccess is a browser-based SCADA software package for monitoring, data acquisition, and visualization. It is used to automate complex industrial processes when remote operation is required

Trust: 10.62

sources: NVD: CVE-2020-10638 // ZDI: ZDI-20-601 // ZDI: ZDI-20-596 // ZDI: ZDI-20-616 // ZDI: ZDI-20-623 // ZDI: ZDI-20-618 // ZDI: ZDI-20-621 // ZDI: ZDI-20-635 // ZDI: ZDI-20-600 // ZDI: ZDI-20-604 // ZDI: ZDI-20-603 // ZDI: ZDI-20-631 // ZDI: ZDI-20-599 // ZDI: ZDI-20-597 // ZDI: ZDI-20-593 // CNVD: CNVD-2020-29739 // IVD: 619b16c7-a995-4cdf-b7be-d91e2bdc75ec // IVD: 95f15ed9-abd1-4fa7-b3b8-cce038c93754

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.0

sources: IVD: 95f15ed9-abd1-4fa7-b3b8-cce038c93754 // IVD: 619b16c7-a995-4cdf-b7be-d91e2bdc75ec // CNVD: CNVD-2020-29739

AFFECTED PRODUCTS

vendor:advantechmodel:webaccess/scadascope: - version: -

Trust: 9.8

vendor:advantechmodel:webaccessscope:lteversion:8.4.4

Trust: 1.0

vendor:advantechmodel:webaccessscope:eqversion:9.0.0

Trust: 1.0

vendor:advantechmodel:webaccess nodescope:gteversion:8.4.4

Trust: 0.6

vendor:advantechmodel:webaccess nodescope:eqversion:9.0.0

Trust: 0.6

vendor:webaccessmodel: - scope:eqversion:*

Trust: 0.4

vendor:webaccessmodel: - scope:eqversion:9.0.0

Trust: 0.4

sources: IVD: 95f15ed9-abd1-4fa7-b3b8-cce038c93754 // IVD: 619b16c7-a995-4cdf-b7be-d91e2bdc75ec // ZDI: ZDI-20-593 // ZDI: ZDI-20-597 // ZDI: ZDI-20-599 // ZDI: ZDI-20-631 // ZDI: ZDI-20-603 // ZDI: ZDI-20-604 // ZDI: ZDI-20-601 // ZDI: ZDI-20-600 // ZDI: ZDI-20-635 // ZDI: ZDI-20-621 // ZDI: ZDI-20-618 // ZDI: ZDI-20-623 // ZDI: ZDI-20-616 // ZDI: ZDI-20-596 // CNVD: CNVD-2020-29739 // NVD: CVE-2020-10638

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI: CVE-2020-10638
value: CRITICAL

Trust: 9.1

nvd@nist.gov: CVE-2020-10638
value: CRITICAL

Trust: 1.0

ZDI: CVE-2020-10638
value: HIGH

Trust: 0.7

CNVD: CNVD-2020-29739
value: HIGH

Trust: 0.6

CNNVD: CNNVD-202005-295
value: CRITICAL

Trust: 0.6

IVD: 95f15ed9-abd1-4fa7-b3b8-cce038c93754
value: HIGH

Trust: 0.2

IVD: 619b16c7-a995-4cdf-b7be-d91e2bdc75ec
value: HIGH

Trust: 0.2

nvd@nist.gov: CVE-2020-10638
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

CNVD: CNVD-2020-29739
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 95f15ed9-abd1-4fa7-b3b8-cce038c93754
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: 619b16c7-a995-4cdf-b7be-d91e2bdc75ec
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

ZDI: CVE-2020-10638
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 9.1

nvd@nist.gov: CVE-2020-10638
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

ZDI: CVE-2020-10638
baseSeverity: HIGH
baseScore: 8.1
vectorString: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.2
impactScore: 5.9
version: 3.0

Trust: 0.7

sources: IVD: 95f15ed9-abd1-4fa7-b3b8-cce038c93754 // IVD: 619b16c7-a995-4cdf-b7be-d91e2bdc75ec // ZDI: ZDI-20-593 // ZDI: ZDI-20-597 // ZDI: ZDI-20-599 // ZDI: ZDI-20-631 // ZDI: ZDI-20-603 // ZDI: ZDI-20-604 // ZDI: ZDI-20-601 // ZDI: ZDI-20-600 // ZDI: ZDI-20-635 // ZDI: ZDI-20-621 // ZDI: ZDI-20-618 // ZDI: ZDI-20-623 // ZDI: ZDI-20-616 // ZDI: ZDI-20-596 // CNVD: CNVD-2020-29739 // CNNVD: CNNVD-202005-295 // NVD: CVE-2020-10638

PROBLEMTYPE DATA

problemtype:CWE-122

Trust: 1.0

problemtype:CWE-787

Trust: 1.0

sources: NVD: CVE-2020-10638

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202005-295

TYPE

Buffer error

Trust: 1.0

sources: IVD: 95f15ed9-abd1-4fa7-b3b8-cce038c93754 // IVD: 619b16c7-a995-4cdf-b7be-d91e2bdc75ec // CNNVD: CNNVD-202005-295

PATCH

title:Advantech has issued an update to correct this vulnerability.url:https://www.us-cert.gov/ics/advisories/icsa-20-128-36

Trust: 9.8

title:Patch for Advantech WebAccess Node buffer overflow vulnerability (CNVD-2020-29739)url:https://www.cnvd.org.cn/patchInfo/show/218845

Trust: 0.6

title:Advantech WebAccess Node Buffer error vulnerability fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=118647

Trust: 0.6

sources: ZDI: ZDI-20-593 // ZDI: ZDI-20-597 // ZDI: ZDI-20-599 // ZDI: ZDI-20-631 // ZDI: ZDI-20-603 // ZDI: ZDI-20-604 // ZDI: ZDI-20-601 // ZDI: ZDI-20-600 // ZDI: ZDI-20-635 // ZDI: ZDI-20-621 // ZDI: ZDI-20-618 // ZDI: ZDI-20-623 // ZDI: ZDI-20-616 // ZDI: ZDI-20-596 // CNVD: CNVD-2020-29739 // CNNVD: CNNVD-202005-295

EXTERNAL IDS

db:NVDid:CVE-2020-10638

Trust: 12.4

db:ZDIid:ZDI-20-593

Trust: 2.3

db:ZDIid:ZDI-20-599

Trust: 2.3

db:ZDIid:ZDI-20-603

Trust: 2.3

db:ZDIid:ZDI-20-600

Trust: 2.3

db:ZDIid:ZDI-20-621

Trust: 2.3

db:ZDIid:ZDI-20-616

Trust: 2.3

db:ICS CERTid:ICSA-20-128-01

Trust: 2.2

db:ZDIid:ZDI-20-635

Trust: 1.3

db:CNVDid:CNVD-2020-29739

Trust: 1.0

db:CNNVDid:CNNVD-202005-295

Trust: 1.0

db:ZDI_CANid:ZDI-CAN-9902

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9985

Trust: 0.7

db:ZDIid:ZDI-20-597

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9994

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9892

Trust: 0.7

db:ZDIid:ZDI-20-631

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9897

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9898

Trust: 0.7

db:ZDIid:ZDI-20-604

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9998

Trust: 0.7

db:ZDIid:ZDI-20-601

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9997

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-10026

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-10085

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9891

Trust: 0.7

db:ZDIid:ZDI-20-618

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-10337

Trust: 0.7

db:ZDIid:ZDI-20-623

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9889

Trust: 0.7

db:ZDI_CANid:ZDI-CAN-9908

Trust: 0.7

db:ZDIid:ZDI-20-596

Trust: 0.7

db:NSFOCUSid:47382

Trust: 0.6

db:AUSCERTid:ESB-2020.1646

Trust: 0.6

db:IVDid:95F15ED9-ABD1-4FA7-B3B8-CCE038C93754

Trust: 0.2

db:IVDid:619B16C7-A995-4CDF-B7BE-D91E2BDC75EC

Trust: 0.2

sources: IVD: 95f15ed9-abd1-4fa7-b3b8-cce038c93754 // IVD: 619b16c7-a995-4cdf-b7be-d91e2bdc75ec // ZDI: ZDI-20-593 // ZDI: ZDI-20-597 // ZDI: ZDI-20-599 // ZDI: ZDI-20-631 // ZDI: ZDI-20-603 // ZDI: ZDI-20-604 // ZDI: ZDI-20-601 // ZDI: ZDI-20-600 // ZDI: ZDI-20-635 // ZDI: ZDI-20-621 // ZDI: ZDI-20-618 // ZDI: ZDI-20-623 // ZDI: ZDI-20-616 // ZDI: ZDI-20-596 // CNVD: CNVD-2020-29739 // CNNVD: CNNVD-202005-295 // NVD: CVE-2020-10638

REFERENCES

url:https://www.us-cert.gov/ics/advisories/icsa-20-128-36

Trust: 9.8

url:https://www.us-cert.gov/ics/advisories/icsa-20-128-01

Trust: 2.8

url:https://www.zerodayinitiative.com/advisories/zdi-20-616/

Trust: 1.6

url:https://www.zerodayinitiative.com/advisories/zdi-20-603/

Trust: 1.6

url:https://www.zerodayinitiative.com/advisories/zdi-20-600/

Trust: 1.6

url:https://www.zerodayinitiative.com/advisories/zdi-20-599/

Trust: 1.6

url:https://www.zerodayinitiative.com/advisories/zdi-20-621/

Trust: 1.6

url:https://www.zerodayinitiative.com/advisories/zdi-20-593/

Trust: 1.6

url:https://www.zerodayinitiative.com/advisories/zdi-20-635/

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2020-10638

Trust: 0.6

url:http://www.nsfocus.net/vulndb/47382

Trust: 0.6

url:https://www.auscert.org.au/bulletins/esb-2020.1646/

Trust: 0.6

sources: ZDI: ZDI-20-593 // ZDI: ZDI-20-597 // ZDI: ZDI-20-599 // ZDI: ZDI-20-631 // ZDI: ZDI-20-603 // ZDI: ZDI-20-604 // ZDI: ZDI-20-601 // ZDI: ZDI-20-600 // ZDI: ZDI-20-635 // ZDI: ZDI-20-621 // ZDI: ZDI-20-618 // ZDI: ZDI-20-623 // ZDI: ZDI-20-616 // ZDI: ZDI-20-596 // CNVD: CNVD-2020-29739 // CNNVD: CNNVD-202005-295 // NVD: CVE-2020-10638

CREDITS

Z0mb1E

Trust: 9.8

sources: ZDI: ZDI-20-593 // ZDI: ZDI-20-597 // ZDI: ZDI-20-599 // ZDI: ZDI-20-631 // ZDI: ZDI-20-603 // ZDI: ZDI-20-604 // ZDI: ZDI-20-601 // ZDI: ZDI-20-600 // ZDI: ZDI-20-635 // ZDI: ZDI-20-621 // ZDI: ZDI-20-618 // ZDI: ZDI-20-623 // ZDI: ZDI-20-616 // ZDI: ZDI-20-596

SOURCES

db:IVDid:95f15ed9-abd1-4fa7-b3b8-cce038c93754
db:IVDid:619b16c7-a995-4cdf-b7be-d91e2bdc75ec
db:ZDIid:ZDI-20-593
db:ZDIid:ZDI-20-597
db:ZDIid:ZDI-20-599
db:ZDIid:ZDI-20-631
db:ZDIid:ZDI-20-603
db:ZDIid:ZDI-20-604
db:ZDIid:ZDI-20-601
db:ZDIid:ZDI-20-600
db:ZDIid:ZDI-20-635
db:ZDIid:ZDI-20-621
db:ZDIid:ZDI-20-618
db:ZDIid:ZDI-20-623
db:ZDIid:ZDI-20-616
db:ZDIid:ZDI-20-596
db:CNVDid:CNVD-2020-29739
db:CNNVDid:CNNVD-202005-295
db:NVDid:CVE-2020-10638

LAST UPDATE DATE

2024-12-21T22:56:06.986000+00:00


SOURCES UPDATE DATE

db:ZDIid:ZDI-20-593date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-597date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-599date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-631date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-603date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-604date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-601date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-600date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-635date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-621date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-618date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-623date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-616date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-596date:2020-05-08T00:00:00
db:CNVDid:CNVD-2020-29739date:2020-05-25T00:00:00
db:CNNVDid:CNNVD-202005-295date:2021-01-04T00:00:00
db:NVDid:CVE-2020-10638date:2024-11-21T04:55:45.027

SOURCES RELEASE DATE

db:IVDid:95f15ed9-abd1-4fa7-b3b8-cce038c93754date:2020-05-07T00:00:00
db:IVDid:619b16c7-a995-4cdf-b7be-d91e2bdc75ecdate:2020-05-07T00:00:00
db:ZDIid:ZDI-20-593date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-597date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-599date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-631date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-603date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-604date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-601date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-600date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-635date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-621date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-618date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-623date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-616date:2020-05-08T00:00:00
db:ZDIid:ZDI-20-596date:2020-05-08T00:00:00
db:CNVDid:CNVD-2020-29739date:2020-05-25T00:00:00
db:CNNVDid:CNNVD-202005-295date:2020-05-07T00:00:00
db:NVDid:CVE-2020-10638date:2020-05-08T12:15:11.067