CVE-2024-2453
Advantech WebAccess/SCADA SQL Injection
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Advantech WebAccess/SCADA SQL Injection
| Assigner | icscert |
| Reserved | 2024-03-14 |
| Published | 2024-03-21 |
| Updated | 2024-08-01 |
There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database.
| CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N |
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CISA discovered a public proof of concept as authored by Prześlij Komentarz and reported it to Advantech.
https://www.cisa.gov/news-events/ics-advisories/icsa-24-081-01
