CVE-2023-1437: Buffer Overflow
All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent client could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute commands and overwrite files.
Other sources
All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute commands and overwrite files.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-1437?
CVE-2023-1437 is a vulnerability in Advantech WebAccess/SCADA versions prior to 9.1.4 that allows an attacker to gain access to the remote file system and execute arbitrary code.
What is the severity of CVE-2023-1437?
The severity of CVE-2023-1437 is critical with a CVSS score of 9.8.
Which versions of Advantech WebAccess/SCADA are affected by CVE-2023-1437?
Versions prior to 9.1.4 of Advantech WebAccess/SCADA are affected by CVE-2023-1437.
How can an attacker exploit CVE-2023-1437?
An attacker can exploit CVE-2023-1437 by sending RPC arguments with raw memory pointers to gain access to the remote file system and execute arbitrary code.
Is there a fix available for CVE-2023-1437?
Yes, upgrading to version 9.1.4 of Advantech WebAccess/SCADA will mitigate the vulnerability.