CVE-2023-32540: Code Injection

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2023-32540.

Q: What is the severity of CVE-2023-32540?

The severity of CVE-2023-32540 is critical with a score of 9.8.

Q: Which software versions are affected by CVE-2023-32540?

Advantech WebAccss/SCADA versions up to and including 9.1.3 are affected by CVE-2023-32540.

Q: What can an attacker do with CVE-2023-32540?

The attacker can overwrite any file in the operating system, inject code into an XLS file, and modify the file extension.

Q: Is there a fix available for CVE-2023-32540?

At the moment, there is no information available regarding a fix for CVE-2023-32540. It is recommended to follow security advisories and updates from Advantech.

Published Jun 5, 2023

Updated

In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the operating system (including system files), inject code into an XLS file, and modify the file extension, which could lead to arbitrary code execution.

Affected Software

2 affected components

Advantech Webaccess\/scada<=9.1.3

Advantech WebAccess/SCADA versions 9.1.3 and prior

Remediation

Information

Advantech recommends WebAccess/SCADA users upgrade to v9.1.4 https://www.advantech.com/en/support/details/installation .

Event History

Jun 5, 2023

CVE Published

via MITRE·11:16 PM

Data Sourced

via MITRE·11:16 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-23-152-01

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2023-32540.

What is the severity of CVE-2023-32540?

The severity of CVE-2023-32540 is critical with a score of 9.8.

Which software versions are affected by CVE-2023-32540?