CVE-2020-10638: Advantech WebAccess/SCADA DATACORE IOCTL 0x0000791c Heap-based Buffer Overflow Remote Code Execution Vulnerability
Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/SCADA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the BwTCPIP device driver. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of Administrator.
— ZDI
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/SCADA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of IOCTL 0x00002723 in DrawSrv.dll. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of Administrator.
— ZDI
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/SCADA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of IOCTL 0x00002723 in ViewSrv.dll. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of Administrator.
— ZDI
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/SCADA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of IOCTL 0x0000791c in DATACORE.exe. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of Administrator.
— ZDI
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/SCADA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of IOCTL 0x0000791e in DATACORE.exe. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of Administrator.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-10638?
CVE-2020-10638 is a vulnerability that allows remote attackers to execute arbitrary code on affected installations of Advantech WebAccess/SCADA.
Is authentication required to exploit CVE-2020-10638?
No, authentication is not required to exploit this vulnerability.
How severe is CVE-2020-10638?
CVE-2020-10638 has a severity rating of 9.8, which is considered critical.
What software is affected by CVE-2020-10638?
CVE-2020-10638 affects installations of Advantech WebAccess/SCADA versions up to and including 8.4.4, as well as version 9.0.0.
How can CVE-2020-10638 be mitigated?
At the moment, there is no official patch available. However, it is recommended to follow the recommendations provided by the vendor and monitor the vendor's website for any updates or patches.