THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Fathom (Privacy friendly web analytics)
Zendesk (Helpdesk and Chat)

Ok

Home | EN
Support
CVE
PUBLISHED

CVE-2024-2453

Advantech WebAccess/SCADA SQL Injection

Assignericscert
Reserved2024-03-14
Published2024-03-21
Updated2024-07-08

Description

There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database.



MEDIUM: 6.4CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

9.1.5U
affected

Credits

CISA discovered a public proof of concept as authored by Prześlij Komentarz and reported it to Advantech. finder

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-081-01 government-resource

cve.org CVE-2024-2453

nvd.nist.gov CVE-2024-2453

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-2453
© Copyright 2024 THREATINT. Made in Cyprus with +