CVE-2020-14507: Advantech iView LinksTable exportLinks Directory Traversal Remote Code Execution Vulnerability
Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code.
Other sources
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MenuServlet servlet. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose information in the context of SYSTEM.
— ZDI
This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the importZtpConfiguration method of the ZTPConfig class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to disclose files in the context of SYSTEM.
— ZDI
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetworkServlet servlet. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
— ZDI
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the exportLinks method of the LinksTable class. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2020-14507.
What is the title of the vulnerability?
The title of the vulnerability is Advantech iView MenuServlet Directory Traversal Information Disclosure Vulnerability.
What is the severity of CVE-2020-14507?
The severity of CVE-2020-14507 is critical with a CVSS score of 9.8.
What software is affected by CVE-2020-14507?
Advantech iView versions up to and including 5.6 are affected by CVE-2020-14507.
How can the vulnerability be exploited?
Remote attackers can exploit this vulnerability without authentication by executing arbitrary code on affected installations of Advantech iView.