var-201906-1029
Vulnerability from variot

In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute arbitrary code. WebAccess/SCADA Is NULL A vulnerability related to pointer dereference exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x2776 IOCTL in the webvrpcs process. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of Administrator. Advantech WebAccess/SCADA is a browser-based SCADA software from Advantech, Taiwan. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. Advantech WebAccess/SCADA is prone to the following security vulnerabilities: 1. A directory-traversal vulnerability 2. Multiple stack-based buffer-overflow vulnerabilities 3. Multiple heap-based buffer-overflow vulnerabilities 4. An information disclosure vulnerability 5. Multiple remote-code execution vulnerabilities An attacker can exploit these issues to execute arbitrary code in the context of the application, modify and delete files, use directory-traversal sequences (â??../â??) to retrieve arbitrary files, escalate privileges and perform certain unauthorized actions or obtain sensitive information. This may aid in further attacks. Advantech WebAccess/SCADA Versions 8.3.5 and prior versions are vulnerable. This vulnerability stems from improper design or implementation problems in the code development process of network systems or products

Show details on source website

To clipboard 

{
   affected_products: {
      _id: null,
      data: [
         {
            _id: null,
            model: "webaccess",
            scope: null,
            trust: 8.4,
            vendor: "advantech",
            version: null,
         },
         {
            _id: null,
            model: "webaccess",
            scope: "lte",
            trust: 1.8,
            vendor: "advantech",
            version: "8.3.5",
         },
         {
            _id: null,
            model: "webaccess/scada",
            scope: "lte",
            trust: 0.6,
            vendor: "advantech",
            version: "<=8.3.5",
         },
         {
            _id: null,
            model: "webaccess/scada",
            scope: "eq",
            trust: 0.3,
            vendor: "advantech",
            version: "8.3.5",
         },
         {
            _id: null,
            model: "webaccess/scada",
            scope: "eq",
            trust: 0.3,
            vendor: "advantech",
            version: "8.3.4",
         },
         {
            _id: null,
            model: "webaccess/scada",
            scope: "eq",
            trust: 0.3,
            vendor: "advantech",
            version: "8.3.2",
         },
         {
            _id: null,
            model: "webaccess/scada",
            scope: "eq",
            trust: 0.3,
            vendor: "advantech",
            version: "8.3",
         },
         {
            _id: null,
            model: "webaccess/scada",
            scope: "eq",
            trust: 0.3,
            vendor: "advantech",
            version: "8.1",
         },
         {
            _id: null,
            model: "webaccess/scada",
            scope: "eq",
            trust: 0.3,
            vendor: "advantech",
            version: "8.0",
         },
         {
            _id: null,
            model: "webaccess/scada",
            scope: "eq",
            trust: 0.3,
            vendor: "advantech",
            version: "7.2",
         },
         {
            _id: null,
            model: "webaccess/scada",
            scope: "ne",
            trust: 0.3,
            vendor: "advantech",
            version: "8.4.1",
         },
         {
            _id: null,
            model: null,
            scope: "eq",
            trust: 0.2,
            vendor: "webaccess",
            version: "*",
         },
      ],
      sources: [
         {
            db: "IVD",
            id: "d5dcd84f-1aca-4dc3-ac16-d5c7c3dd4d07",
         },
         {
            db: "ZDI",
            id: "ZDI-19-599",
         },
         {
            db: "ZDI",
            id: "ZDI-19-613",
         },
         {
            db: "ZDI",
            id: "ZDI-19-610",
         },
         {
            db: "ZDI",
            id: "ZDI-19-616",
         },
         {
            db: "ZDI",
            id: "ZDI-19-606",
         },
         {
            db: "ZDI",
            id: "ZDI-19-595",
         },
         {
            db: "ZDI",
            id: "ZDI-19-598",
         },
         {
            db: "ZDI",
            id: "ZDI-19-605",
         },
         {
            db: "ZDI",
            id: "ZDI-19-596",
         },
         {
            db: "ZDI",
            id: "ZDI-19-615",
         },
         {
            db: "ZDI",
            id: "ZDI-19-608",
         },
         {
            db: "ZDI",
            id: "ZDI-19-618",
         },
         {
            db: "CNVD",
            id: "CNVD-2019-32473",
         },
         {
            db: "BID",
            id: "108923",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-005812",
         },
         {
            db: "NVD",
            id: "CVE-2019-10993",
         },
      ],
   },
   configurations: {
      _id: null,
      data: [
         {
            CVE_data_version: "4.0",
            nodes: [
               {
                  children: [],
                  cpe_match: [
                     {
                        cpe23Uri: "cpe:2.3:a:advantech:webaccess:*:*:*:*:*:*:*:*",
                        cpe_name: [],
                        versionEndIncluding: "8.3.5",
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
            ],
         },
      ],
      sources: [
         {
            db: "NVD",
            id: "CVE-2019-10993",
         },
      ],
   },
   credits: {
      _id: null,
      data: "Natnael Samson (@NattiSamson)",
      sources: [
         {
            db: "ZDI",
            id: "ZDI-19-599",
         },
         {
            db: "ZDI",
            id: "ZDI-19-613",
         },
         {
            db: "ZDI",
            id: "ZDI-19-610",
         },
         {
            db: "ZDI",
            id: "ZDI-19-616",
         },
         {
            db: "ZDI",
            id: "ZDI-19-606",
         },
         {
            db: "ZDI",
            id: "ZDI-19-595",
         },
         {
            db: "ZDI",
            id: "ZDI-19-598",
         },
         {
            db: "ZDI",
            id: "ZDI-19-605",
         },
         {
            db: "ZDI",
            id: "ZDI-19-596",
         },
         {
            db: "ZDI",
            id: "ZDI-19-615",
         },
         {
            db: "ZDI",
            id: "ZDI-19-608",
         },
         {
            db: "ZDI",
            id: "ZDI-19-618",
         },
      ],
      trust: 8.4,
   },
   cve: "CVE-2019-10993",
   cvss: {
      _id: null,
      data: [
         {
            cvssV2: [
               {
                  acInsufInfo: false,
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  author: "NVD",
                  availabilityImpact: "PARTIAL",
                  baseScore: 7.5,
                  confidentialityImpact: "PARTIAL",
                  exploitabilityScore: 10,
                  impactScore: 6.4,
                  integrityImpact: "PARTIAL",
                  obtainAllPrivilege: false,
                  obtainOtherPrivilege: false,
                  obtainUserPrivilege: false,
                  severity: "HIGH",
                  trust: 1,
                  userInteractionRequired: false,
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
               {
                  acInsufInfo: null,
                  accessComplexity: "Low",
                  accessVector: "Network",
                  authentication: "None",
                  author: "NVD",
                  availabilityImpact: "Partial",
                  baseScore: 7.5,
                  confidentialityImpact: "Partial",
                  exploitabilityScore: null,
                  id: "CVE-2019-10993",
                  impactScore: null,
                  integrityImpact: "Partial",
                  obtainAllPrivilege: null,
                  obtainOtherPrivilege: null,
                  obtainUserPrivilege: null,
                  severity: "High",
                  trust: 0.8,
                  userInteractionRequired: null,
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
               {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  author: "CNVD",
                  availabilityImpact: "PARTIAL",
                  baseScore: 7.5,
                  confidentialityImpact: "PARTIAL",
                  exploitabilityScore: 10,
                  id: "CNVD-2019-32473",
                  impactScore: 6.4,
                  integrityImpact: "PARTIAL",
                  severity: "HIGH",
                  trust: 0.6,
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                  version: "2.0",
               },
               {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  author: "IVD",
                  availabilityImpact: "PARTIAL",
                  baseScore: 7.5,
                  confidentialityImpact: "PARTIAL",
                  exploitabilityScore: 10,
                  id: "d5dcd84f-1aca-4dc3-ac16-d5c7c3dd4d07",
                  impactScore: 6.4,
                  integrityImpact: "PARTIAL",
                  severity: "HIGH",
                  trust: 0.2,
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:P/A:P",
                  version: "2.9 [IVD]",
               },
               {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  author: "VULHUB",
                  availabilityImpact: "PARTIAL",
                  baseScore: 7.5,
                  confidentialityImpact: "PARTIAL",
                  exploitabilityScore: 10,
                  id: "VHN-142595",
                  impactScore: 6.4,
                  integrityImpact: "PARTIAL",
                  severity: "HIGH",
                  trust: 0.1,
                  vectorString: "AV:N/AC:L/AU:N/C:P/I:P/A:P",
                  version: "2.0",
               },
            ],
            cvssV3: [
               {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  author: "ZDI",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  exploitabilityScore: 3.9,
                  id: "CVE-2019-10993",
                  impactScore: 5.9,
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  trust: 8.4,
                  userInteraction: "NONE",
                  vectorString: "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  author: "NVD",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  exploitabilityScore: 3.9,
                  impactScore: 5.9,
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  trust: 1,
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               {
                  attackComplexity: "Low",
                  attackVector: "Network",
                  author: "NVD",
                  availabilityImpact: "High",
                  baseScore: 9.8,
                  baseSeverity: "Critical",
                  confidentialityImpact: "High",
                  exploitabilityScore: null,
                  id: "CVE-2019-10993",
                  impactScore: null,
                  integrityImpact: "High",
                  privilegesRequired: "None",
                  scope: "Unchanged",
                  trust: 0.8,
                  userInteraction: "None",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
            ],
            severity: [
               {
                  author: "ZDI",
                  id: "CVE-2019-10993",
                  trust: 8.4,
                  value: "CRITICAL",
               },
               {
                  author: "NVD",
                  id: "CVE-2019-10993",
                  trust: 1.8,
                  value: "CRITICAL",
               },
               {
                  author: "CNVD",
                  id: "CNVD-2019-32473",
                  trust: 0.6,
                  value: "HIGH",
               },
               {
                  author: "CNNVD",
                  id: "CNNVD-201906-1077",
                  trust: 0.6,
                  value: "CRITICAL",
               },
               {
                  author: "IVD",
                  id: "d5dcd84f-1aca-4dc3-ac16-d5c7c3dd4d07",
                  trust: 0.2,
                  value: "CRITICAL",
               },
               {
                  author: "VULHUB",
                  id: "VHN-142595",
                  trust: 0.1,
                  value: "HIGH",
               },
            ],
         },
      ],
      sources: [
         {
            db: "IVD",
            id: "d5dcd84f-1aca-4dc3-ac16-d5c7c3dd4d07",
         },
         {
            db: "ZDI",
            id: "ZDI-19-599",
         },
         {
            db: "ZDI",
            id: "ZDI-19-613",
         },
         {
            db: "ZDI",
            id: "ZDI-19-610",
         },
         {
            db: "ZDI",
            id: "ZDI-19-616",
         },
         {
            db: "ZDI",
            id: "ZDI-19-606",
         },
         {
            db: "ZDI",
            id: "ZDI-19-595",
         },
         {
            db: "ZDI",
            id: "ZDI-19-598",
         },
         {
            db: "ZDI",
            id: "ZDI-19-605",
         },
         {
            db: "ZDI",
            id: "ZDI-19-596",
         },
         {
            db: "ZDI",
            id: "ZDI-19-615",
         },
         {
            db: "ZDI",
            id: "ZDI-19-608",
         },
         {
            db: "ZDI",
            id: "ZDI-19-618",
         },
         {
            db: "CNVD",
            id: "CNVD-2019-32473",
         },
         {
            db: "VULHUB",
            id: "VHN-142595",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-005812",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201906-1077",
         },
         {
            db: "NVD",
            id: "CVE-2019-10993",
         },
      ],
   },
   description: {
      _id: null,
      data: "In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute arbitrary code. WebAccess/SCADA Is NULL A vulnerability related to pointer dereference exists.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the 0x2776 IOCTL in the webvrpcs process. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this vulnerability to execute code in the context of Administrator. Advantech WebAccess/SCADA is a browser-based SCADA software from Advantech, Taiwan. The software supports dynamic graphical display and real-time data control, and provides the ability to remotely control and manage automation equipment. Advantech WebAccess/SCADA is prone to the following security vulnerabilities:\n1. A directory-traversal vulnerability\n2. Multiple stack-based buffer-overflow vulnerabilities\n3. Multiple heap-based buffer-overflow vulnerabilities\n4. An information disclosure vulnerability\n5. Multiple remote-code execution vulnerabilities\nAn attacker can exploit these issues to execute arbitrary code in the context of the application, modify and delete files, use directory-traversal sequences (â??../â??) to retrieve arbitrary files, escalate privileges and perform certain unauthorized actions or obtain sensitive information. This may aid in further attacks. \nAdvantech WebAccess/SCADA Versions 8.3.5 and prior versions are vulnerable. This vulnerability stems from improper design or implementation problems in the code development process of network systems or products",
      sources: [
         {
            db: "NVD",
            id: "CVE-2019-10993",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-005812",
         },
         {
            db: "ZDI",
            id: "ZDI-19-605",
         },
         {
            db: "ZDI",
            id: "ZDI-19-618",
         },
         {
            db: "ZDI",
            id: "ZDI-19-608",
         },
         {
            db: "ZDI",
            id: "ZDI-19-615",
         },
         {
            db: "ZDI",
            id: "ZDI-19-599",
         },
         {
            db: "ZDI",
            id: "ZDI-19-596",
         },
         {
            db: "ZDI",
            id: "ZDI-19-598",
         },
         {
            db: "ZDI",
            id: "ZDI-19-595",
         },
         {
            db: "ZDI",
            id: "ZDI-19-606",
         },
         {
            db: "ZDI",
            id: "ZDI-19-616",
         },
         {
            db: "ZDI",
            id: "ZDI-19-610",
         },
         {
            db: "ZDI",
            id: "ZDI-19-613",
         },
         {
            db: "CNVD",
            id: "CNVD-2019-32473",
         },
         {
            db: "BID",
            id: "108923",
         },
         {
            db: "IVD",
            id: "d5dcd84f-1aca-4dc3-ac16-d5c7c3dd4d07",
         },
         {
            db: "VULHUB",
            id: "VHN-142595",
         },
      ],
      trust: 10.26,
   },
   external_ids: {
      _id: null,
      data: [
         {
            db: "NVD",
            id: "CVE-2019-10993",
            trust: 12,
         },
         {
            db: "ICS CERT",
            id: "ICSA-19-178-05",
            trust: 2.8,
         },
         {
            db: "ZDI",
            id: "ZDI-19-613",
            trust: 2.4,
         },
         {
            db: "ZDI",
            id: "ZDI-19-616",
            trust: 2.4,
         },
         {
            db: "ZDI",
            id: "ZDI-19-606",
            trust: 2.4,
         },
         {
            db: "ZDI",
            id: "ZDI-19-598",
            trust: 2.4,
         },
         {
            db: "ZDI",
            id: "ZDI-19-605",
            trust: 2.4,
         },
         {
            db: "ZDI",
            id: "ZDI-19-615",
            trust: 2.4,
         },
         {
            db: "ZDI",
            id: "ZDI-19-618",
            trust: 2.4,
         },
         {
            db: "ZDI",
            id: "ZDI-19-612",
            trust: 1.7,
         },
         {
            db: "ZDI",
            id: "ZDI-19-611",
            trust: 1.7,
         },
         {
            db: "ZDI",
            id: "ZDI-19-602",
            trust: 1.7,
         },
         {
            db: "ZDI",
            id: "ZDI-19-607",
            trust: 1.7,
         },
         {
            db: "ZDI",
            id: "ZDI-19-614",
            trust: 1.7,
         },
         {
            db: "ZDI",
            id: "ZDI-19-597",
            trust: 1.7,
         },
         {
            db: "ZDI",
            id: "ZDI-19-617",
            trust: 1.7,
         },
         {
            db: "ZDI",
            id: "ZDI-19-603",
            trust: 1.7,
         },
         {
            db: "ZDI",
            id: "ZDI-19-601",
            trust: 1.7,
         },
         {
            db: "ZDI",
            id: "ZDI-19-623",
            trust: 1.7,
         },
         {
            db: "CNNVD",
            id: "CNNVD-201906-1077",
            trust: 0.9,
         },
         {
            db: "BID",
            id: "108923",
            trust: 0.9,
         },
         {
            db: "CNVD",
            id: "CNVD-2019-32473",
            trust: 0.8,
         },
         {
            db: "ZDI",
            id: "ZDI-19-599",
            trust: 0.8,
         },
         {
            db: "ZDI",
            id: "ZDI-19-610",
            trust: 0.8,
         },
         {
            db: "ZDI",
            id: "ZDI-19-595",
            trust: 0.8,
         },
         {
            db: "ZDI",
            id: "ZDI-19-596",
            trust: 0.8,
         },
         {
            db: "ZDI",
            id: "ZDI-19-608",
            trust: 0.8,
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-005812",
            trust: 0.8,
         },
         {
            db: "ZDI_CAN",
            id: "ZDI-CAN-8129",
            trust: 0.7,
         },
         {
            db: "ZDI_CAN",
            id: "ZDI-CAN-8146",
            trust: 0.7,
         },
         {
            db: "ZDI_CAN",
            id: "ZDI-CAN-8143",
            trust: 0.7,
         },
         {
            db: "ZDI_CAN",
            id: "ZDI-CAN-8150",
            trust: 0.7,
         },
         {
            db: "ZDI_CAN",
            id: "ZDI-CAN-8139",
            trust: 0.7,
         },
         {
            db: "ZDI_CAN",
            id: "ZDI-CAN-8118",
            trust: 0.7,
         },
         {
            db: "ZDI_CAN",
            id: "ZDI-CAN-8128",
            trust: 0.7,
         },
         {
            db: "ZDI_CAN",
            id: "ZDI-CAN-8138",
            trust: 0.7,
         },
         {
            db: "ZDI_CAN",
            id: "ZDI-CAN-8126",
            trust: 0.7,
         },
         {
            db: "ZDI_CAN",
            id: "ZDI-CAN-8148",
            trust: 0.7,
         },
         {
            db: "ZDI_CAN",
            id: "ZDI-CAN-8141",
            trust: 0.7,
         },
         {
            db: "ZDI_CAN",
            id: "ZDI-CAN-8152",
            trust: 0.7,
         },
         {
            db: "AUSCERT",
            id: "ESB-2019.2350",
            trust: 0.6,
         },
         {
            db: "IVD",
            id: "D5DCD84F-1ACA-4DC3-AC16-D5C7C3DD4D07",
            trust: 0.2,
         },
         {
            db: "ZDI",
            id: "ZDI-19-604",
            trust: 0.1,
         },
         {
            db: "ZDI",
            id: "ZDI-19-593",
            trust: 0.1,
         },
         {
            db: "ZDI",
            id: "ZDI-19-609",
            trust: 0.1,
         },
         {
            db: "ZDI",
            id: "ZDI-19-600",
            trust: 0.1,
         },
         {
            db: "VULHUB",
            id: "VHN-142595",
            trust: 0.1,
         },
      ],
      sources: [
         {
            db: "IVD",
            id: "d5dcd84f-1aca-4dc3-ac16-d5c7c3dd4d07",
         },
         {
            db: "ZDI",
            id: "ZDI-19-599",
         },
         {
            db: "ZDI",
            id: "ZDI-19-613",
         },
         {
            db: "ZDI",
            id: "ZDI-19-610",
         },
         {
            db: "ZDI",
            id: "ZDI-19-616",
         },
         {
            db: "ZDI",
            id: "ZDI-19-606",
         },
         {
            db: "ZDI",
            id: "ZDI-19-595",
         },
         {
            db: "ZDI",
            id: "ZDI-19-598",
         },
         {
            db: "ZDI",
            id: "ZDI-19-605",
         },
         {
            db: "ZDI",
            id: "ZDI-19-596",
         },
         {
            db: "ZDI",
            id: "ZDI-19-615",
         },
         {
            db: "ZDI",
            id: "ZDI-19-608",
         },
         {
            db: "ZDI",
            id: "ZDI-19-618",
         },
         {
            db: "CNVD",
            id: "CNVD-2019-32473",
         },
         {
            db: "VULHUB",
            id: "VHN-142595",
         },
         {
            db: "BID",
            id: "108923",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-005812",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201906-1077",
         },
         {
            db: "NVD",
            id: "CVE-2019-10993",
         },
      ],
   },
   id: "VAR-201906-1029",
   iot: {
      _id: null,
      data: true,
      sources: [
         {
            db: "IVD",
            id: "d5dcd84f-1aca-4dc3-ac16-d5c7c3dd4d07",
         },
         {
            db: "CNVD",
            id: "CNVD-2019-32473",
         },
         {
            db: "VULHUB",
            id: "VHN-142595",
         },
      ],
      trust: 1.44565702,
   },
   iot_taxonomy: {
      _id: null,
      data: [
         {
            category: [
               "ICS",
            ],
            sub_category: null,
            trust: 0.8,
         },
      ],
      sources: [
         {
            db: "IVD",
            id: "d5dcd84f-1aca-4dc3-ac16-d5c7c3dd4d07",
         },
         {
            db: "CNVD",
            id: "CNVD-2019-32473",
         },
      ],
   },
   last_update_date: "2024-07-23T22:28:26.009000Z",
   patch: {
      _id: null,
      data: [
         {
            title: "Advantech has issued an update to correct this vulnerability.",
            trust: 8.4,
            url: "https://www.us-cert.gov/ics/advisories/icsa-19-178-05",
         },
         {
            title: "Advantech WebAccess",
            trust: 0.8,
            url: "https://www.advantech.co.jp/industrial-automation/webaccess",
         },
         {
            title: "Patch for Advantech WebAccess/SCADA arbitrary code execution vulnerability",
            trust: 0.6,
            url: "https://www.cnvd.org.cn/patchinfo/show/181487",
         },
         {
            title: "Advantech WebAccess/SCADA Security vulnerabilities",
            trust: 0.6,
            url: "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=94180",
         },
      ],
      sources: [
         {
            db: "ZDI",
            id: "ZDI-19-599",
         },
         {
            db: "ZDI",
            id: "ZDI-19-613",
         },
         {
            db: "ZDI",
            id: "ZDI-19-610",
         },
         {
            db: "ZDI",
            id: "ZDI-19-616",
         },
         {
            db: "ZDI",
            id: "ZDI-19-606",
         },
         {
            db: "ZDI",
            id: "ZDI-19-595",
         },
         {
            db: "ZDI",
            id: "ZDI-19-598",
         },
         {
            db: "ZDI",
            id: "ZDI-19-605",
         },
         {
            db: "ZDI",
            id: "ZDI-19-596",
         },
         {
            db: "ZDI",
            id: "ZDI-19-615",
         },
         {
            db: "ZDI",
            id: "ZDI-19-608",
         },
         {
            db: "ZDI",
            id: "ZDI-19-618",
         },
         {
            db: "CNVD",
            id: "CNVD-2019-32473",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-005812",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201906-1077",
         },
      ],
   },
   problemtype_data: {
      _id: null,
      data: [
         {
            problemtype: "CWE-119",
            trust: 1,
         },
         {
            problemtype: "CWE-476",
            trust: 0.9,
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-142595",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-005812",
         },
         {
            db: "NVD",
            id: "CVE-2019-10993",
         },
      ],
   },
   references: {
      _id: null,
      data: [
         {
            trust: 11.2,
            url: "https://www.us-cert.gov/ics/advisories/icsa-19-178-05",
         },
         {
            trust: 2.3,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-623/",
         },
         {
            trust: 2,
            url: "https://nvd.nist.gov/vuln/detail/cve-2019-10993",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-597/",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-598/",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-601/",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-602/",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-603/",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-605/",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-606/",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-607/",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-611/",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-612/",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-613/",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-614/",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-615/",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-616/",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-617/",
         },
         {
            trust: 1.7,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-618/",
         },
         {
            trust: 0.9,
            url: "http://webaccess.advantech.com",
         },
         {
            trust: 0.8,
            url: "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-10993",
         },
         {
            trust: 0.6,
            url: "https://www.securityfocus.com/bid/108923",
         },
         {
            trust: 0.6,
            url: "https://www.auscert.org.au/bulletins/esb-2019.2350/",
         },
         {
            trust: 0.1,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-593/",
         },
         {
            trust: 0.1,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-595/",
         },
         {
            trust: 0.1,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-596/",
         },
         {
            trust: 0.1,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-599/",
         },
         {
            trust: 0.1,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-600/",
         },
         {
            trust: 0.1,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-604/",
         },
         {
            trust: 0.1,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-608/",
         },
         {
            trust: 0.1,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-609/",
         },
         {
            trust: 0.1,
            url: "https://www.zerodayinitiative.com/advisories/zdi-19-610/",
         },
      ],
      sources: [
         {
            db: "ZDI",
            id: "ZDI-19-599",
         },
         {
            db: "ZDI",
            id: "ZDI-19-613",
         },
         {
            db: "ZDI",
            id: "ZDI-19-610",
         },
         {
            db: "ZDI",
            id: "ZDI-19-616",
         },
         {
            db: "ZDI",
            id: "ZDI-19-606",
         },
         {
            db: "ZDI",
            id: "ZDI-19-595",
         },
         {
            db: "ZDI",
            id: "ZDI-19-598",
         },
         {
            db: "ZDI",
            id: "ZDI-19-605",
         },
         {
            db: "ZDI",
            id: "ZDI-19-596",
         },
         {
            db: "ZDI",
            id: "ZDI-19-615",
         },
         {
            db: "ZDI",
            id: "ZDI-19-608",
         },
         {
            db: "ZDI",
            id: "ZDI-19-618",
         },
         {
            db: "CNVD",
            id: "CNVD-2019-32473",
         },
         {
            db: "VULHUB",
            id: "VHN-142595",
         },
         {
            db: "BID",
            id: "108923",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-005812",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201906-1077",
         },
         {
            db: "NVD",
            id: "CVE-2019-10993",
         },
      ],
   },
   sources: {
      _id: null,
      data: [
         {
            db: "IVD",
            id: "d5dcd84f-1aca-4dc3-ac16-d5c7c3dd4d07",
            ident: null,
         },
         {
            db: "ZDI",
            id: "ZDI-19-599",
            ident: null,
         },
         {
            db: "ZDI",
            id: "ZDI-19-613",
            ident: null,
         },
         {
            db: "ZDI",
            id: "ZDI-19-610",
            ident: null,
         },
         {
            db: "ZDI",
            id: "ZDI-19-616",
            ident: null,
         },
         {
            db: "ZDI",
            id: "ZDI-19-606",
            ident: null,
         },
         {
            db: "ZDI",
            id: "ZDI-19-595",
            ident: null,
         },
         {
            db: "ZDI",
            id: "ZDI-19-598",
            ident: null,
         },
         {
            db: "ZDI",
            id: "ZDI-19-605",
            ident: null,
         },
         {
            db: "ZDI",
            id: "ZDI-19-596",
            ident: null,
         },
         {
            db: "ZDI",
            id: "ZDI-19-615",
            ident: null,
         },
         {
            db: "ZDI",
            id: "ZDI-19-608",
            ident: null,
         },
         {
            db: "ZDI",
            id: "ZDI-19-618",
            ident: null,
         },
         {
            db: "CNVD",
            id: "CNVD-2019-32473",
            ident: null,
         },
         {
            db: "VULHUB",
            id: "VHN-142595",
            ident: null,
         },
         {
            db: "BID",
            id: "108923",
            ident: null,
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-005812",
            ident: null,
         },
         {
            db: "CNNVD",
            id: "CNNVD-201906-1077",
            ident: null,
         },
         {
            db: "NVD",
            id: "CVE-2019-10993",
            ident: null,
         },
      ],
   },
   sources_release_date: {
      _id: null,
      data: [
         {
            date: "2019-09-21T00:00:00",
            db: "IVD",
            id: "d5dcd84f-1aca-4dc3-ac16-d5c7c3dd4d07",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-599",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-613",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-610",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-616",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-606",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-595",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-598",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-605",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-596",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-615",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-608",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-618",
            ident: null,
         },
         {
            date: "2019-09-21T00:00:00",
            db: "CNVD",
            id: "CNVD-2019-32473",
            ident: null,
         },
         {
            date: "2019-06-28T00:00:00",
            db: "VULHUB",
            id: "VHN-142595",
            ident: null,
         },
         {
            date: "2019-06-27T00:00:00",
            db: "BID",
            id: "108923",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "JVNDB",
            id: "JVNDB-2019-005812",
            ident: null,
         },
         {
            date: "2019-06-27T00:00:00",
            db: "CNNVD",
            id: "CNNVD-201906-1077",
            ident: null,
         },
         {
            date: "2019-06-28T21:15:11.353000",
            db: "NVD",
            id: "CVE-2019-10993",
            ident: null,
         },
      ],
   },
   sources_update_date: {
      _id: null,
      data: [
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-599",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-613",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-610",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-616",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-606",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-595",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-598",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-605",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-596",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-615",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-608",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "ZDI",
            id: "ZDI-19-618",
            ident: null,
         },
         {
            date: "2019-09-21T00:00:00",
            db: "CNVD",
            id: "CNVD-2019-32473",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "VULHUB",
            id: "VHN-142595",
            ident: null,
         },
         {
            date: "2019-06-27T00:00:00",
            db: "BID",
            id: "108923",
            ident: null,
         },
         {
            date: "2019-07-02T00:00:00",
            db: "JVNDB",
            id: "JVNDB-2019-005812",
            ident: null,
         },
         {
            date: "2022-04-19T00:00:00",
            db: "CNNVD",
            id: "CNNVD-201906-1077",
            ident: null,
         },
         {
            date: "2022-04-18T17:17:47.753000",
            db: "NVD",
            id: "CVE-2019-10993",
            ident: null,
         },
      ],
   },
   threat_type: {
      _id: null,
      data: "remote",
      sources: [
         {
            db: "CNNVD",
            id: "CNNVD-201906-1077",
         },
      ],
      trust: 0.6,
   },
   title: {
      _id: null,
      data: "Advantech WebAccess/SCADA Arbitrary code execution vulnerability",
      sources: [
         {
            db: "IVD",
            id: "d5dcd84f-1aca-4dc3-ac16-d5c7c3dd4d07",
         },
         {
            db: "CNVD",
            id: "CNVD-2019-32473",
         },
      ],
      trust: 0.8,
   },
   type: {
      _id: null,
      data: "buffer error",
      sources: [
         {
            db: "CNNVD",
            id: "CNNVD-201906-1077",
         },
      ],
      trust: 0.6,
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.