CVE-2020-12014: Advantech WebAccess/SCADA BwWebSvc IOCTL 0x00013c71 SQL Injection Information Disclosure Vulnerability
Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Input is not properly sanitized and may allow an attacker to inject SQL commands.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/SCADA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of IOCTL 0x00013c71 in BwWebSvc.dll. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-12014?
CVE-2020-12014 is a vulnerability in Advantech WebAccess/SCADA that allows remote attackers to disclose sensitive information without authentication.
What is the severity of CVE-2020-12014?
The severity of CVE-2020-12014 is high with a CVSS score of 7.5.
How does CVE-2020-12014 work?
This vulnerability exists within the implementation of IOCTL 0x00013c71 in BwWebSvc.dll, allowing remote attackers to perform SQL injection and access sensitive information.
Which versions of Advantech WebAccess/SCADA are affected by CVE-2020-12014?
Advantech WebAccess/SCADA versions up to 8.4.4 and version 9.0.0 are affected by CVE-2020-12014.
How can I fix CVE-2020-12014?
Apply the necessary patches or updates provided by Advantech to mitigate the vulnerability in Advantech WebAccess/SCADA.