CVE-2020-12018: Advantech WebAccess/SCADA ViewSrv IOCTL 0x00002722 Out-Of-Bounds Read Information Disclosure Vulnerability
Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An out-of-bounds vulnerability exists that may allow access to unauthorized data.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/SCADA. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of IOCTL 0x00002722 in ViewSrv.dll. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of Administrator.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-12018?
CVE-2020-12018 is a vulnerability that allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/SCADA.
Is authentication required to exploit CVE-2020-12018?
No, authentication is not required to exploit this vulnerability.
What is the severity of CVE-2020-12018?
The severity of CVE-2020-12018 is high, with a severity value of 7.5.
How does CVE-2020-12018 affect Advantech WebAccess/SCADA?
CVE-2020-12018 affects installations of Advantech WebAccess/SCADA by allowing remote attackers to disclose sensitive information.
How can I fix CVE-2020-12018?
To fix CVE-2020-12018, it is recommended to apply the necessary security patches provided by Advantech.