What is the vulnerability ID for this advisory?

The vulnerability ID for this advisory is CVE-2020-12022.

What is the severity of CVE-2020-12022?

The severity of CVE-2020-12022 is critical with a score of 9.8.

Which software is affected by CVE-2020-12022?

The Advantech WebAccess/SCADA software versions 8.4.4 and 9.0.0 are affected by CVE-2020-12022.

How can an attacker exploit CVE-2020-12022?

An attacker can exploit CVE-2020-12022 by executing arbitrary code on affected installations of Advantech WebAccess/SCADA without requiring authentication.

How can I fix CVE-2020-12022?

To fix CVE-2020-12022, it is recommended to apply the latest security patches or updates provided by Advantech for WebAccess/SCADA.

Vulnerability/
CVE-2020-12022

critical

9.8

CWE

129

8/5/2020

4/8/2024

CVE-2020-12022: Advantech WebAccess/SCADA DATACORE IOCTL 0x0000521e Improper Validation of Array Index Remote Code Execution Vulnerability

First published: Fri May 08 2020(Updated: )

Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially crafted input into memory where it can be executed.

Credit: ics-cert@hq.dhs.gov

Affected Software	Affected Version	How to fix
Advantech WebAccess/SCADA
Advantech WebAccess	<=8.4.4
Advantech WebAccess	=9.0.0

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the vulnerability ID for this advisory?
The vulnerability ID for this advisory is CVE-2020-12022.
What is the severity of CVE-2020-12022?
The severity of CVE-2020-12022 is critical with a score of 9.8.
Which software is affected by CVE-2020-12022?
The Advantech WebAccess/SCADA software versions 8.4.4 and 9.0.0 are affected by CVE-2020-12022.
How can an attacker exploit CVE-2020-12022?
An attacker can exploit CVE-2020-12022 by executing arbitrary code on affected installations of Advantech WebAccess/SCADA without requiring authentication.
How can I fix CVE-2020-12022?
To fix CVE-2020-12022, it is recommended to apply the latest security patches or updates provided by Advantech for WebAccess/SCADA.

collector/nvd-index
agent/type
agent/softwarecombine
collector/mitre-cve
source/MITRE
agent/severity
agent/last-modified-date
agent/title
agent/weakness
agent/references
agent/author
agent/first-publish-date
agent/tags
agent/description
agent/event
collector/zdi-advisory
source/ZDI
alias/ZDI-20-598
alias/ZDI-CAN-9988
alias/CVE-2020-12022
agent/software-canonical-lookup
vendor/advantech
canonical/advantech webaccess
version/advantech webaccess/8.4.4
version/advantech webaccess/9.0.0
canonical/advantech webaccess/scada

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.