{"vulnerability": "CVE-2020-13550", "sightings": [{"uuid": "6aa11da5-647d-4e25-b36e-4f4ba73ab5de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-13550", "type": "seen", "source": "https://t.me/cibsecurity/23774", "content": "\u203c CVE-2020-13550 \u203c\n\nA local file inclusion vulnerability exists in the installation functionality of Advantech WebAccess/SCADA 9.0.1. A specially crafted application can lead to information disclosure. An attacker can send an authenticated HTTP request to trigger this vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-02-17T22:49:21.000000Z"}, {"uuid": "d2235567-76f2-40a5-a763-f7795a70c63d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-13550", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/2750", "content": "#SCADA_Security\nVulnerabilities in Advantech WebAccess/SCADA\n1. CVE-2020-13550:\nAdvantech WebAccess/SCADA installation local file inclusion (PoC)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1168\n2. CVE-2020-13551, CVE-2020-13552, CVE-2020-13553, CVE-2020-13554, CVE-2020-13555:\nAdvantech WebAccess/SCADA installation privilege escalation vulnerability (PoCs)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1169", "creation_timestamp": "2021-02-21T12:53:01.000000Z"}, {"uuid": "d5980fe8-6c8f-46f7-8e40-eb0e1295a1e8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-13550", "type": "seen", "source": "https://t.me/cissp/2360", "content": "Red_Team_Tactics\n1. One thousand and one ways to copy your shellcode to memory (VBA Macros)\nhttps://adepts.of0x.cc/alternatives-copy-shellcode\n\n2. Retrieve LAPS password from the LDAP\ud83d\ude01\nhttps://github.com/swisskyrepo/SharpLAPS\n\n3. A tool to test security of json web token\nhttps://github.com/DontPanicO/jwtXploiter\n\nSCADA_Security\nVulnerabilities in Advantech WebAccess/SCADA\n1. CVE-2020-13550:\nAdvantech WebAccess/SCADA installation local file inclusion (PoC)\nhttps://talosintelligence.com/\nvulnerability_reports/TALOS-2020-1168\n\n2. CVE-2020-13551, CVE-2020-13552, CVE-2020-13553, CVE-2020-13554, CVE-2020-13555:\nAdvantech WebAccess/SCADA installation privilege escalation vulnerability (PoCs)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1169\n\nThreat_Research\nExploiting Out-Of-Band XXE via LOCK Method write-up\nhttps://dhiyaneshgeek.github.io/web/security/2021/02/19/exploiting-out-of-band-xxe\n// The XXE flaw can allow an attacker to turn the XML parser into a proxy which allows local/remote content to be served on request. It allows an attacker to:\n- read files on the application server;\n- interact with any back-end or external systems that the application itself can access", "creation_timestamp": "2026-09-01T17:01:01.943411Z"}, {"uuid": "ae033b87-12ce-4883-b39c-35d1535b90c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-13550", "type": "seen", "source": "https://t.me/cissp/2360", "content": "Red_Team_Tactics\n1. One thousand and one ways to copy your shellcode to memory (VBA Macros)\nhttps://adepts.of0x.cc/alternatives-copy-shellcode\n\n2. Retrieve LAPS password from the LDAP\ud83d\ude01\nhttps://github.com/swisskyrepo/SharpLAPS\n\n3. A tool to test security of json web token\nhttps://github.com/DontPanicO/jwtXploiter\n\nSCADA_Security\nVulnerabilities in Advantech WebAccess/SCADA\n1. CVE-2020-13550:\nAdvantech WebAccess/SCADA installation local file inclusion (PoC)\nhttps://talosintelligence.com/\nvulnerability_reports/TALOS-2020-1168\n\n2. CVE-2020-13551, CVE-2020-13552, CVE-2020-13553, CVE-2020-13554, CVE-2020-13555:\nAdvantech WebAccess/SCADA installation privilege escalation vulnerability (PoCs)\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2020-1169\n\nThreat_Research\nExploiting Out-Of-Band XXE via LOCK Method write-up\nhttps://dhiyaneshgeek.github.io/web/security/2021/02/19/exploiting-out-of-band-xxe\n// The XXE flaw can allow an attacker to turn the XML parser into a proxy which allows local/remote content to be served on request. It allows an attacker to:\n- read files on the application server;\n- interact with any back-end or external systems that the application itself can access", "creation_timestamp": "2026-09-02T01:04:52.083264Z"}]}