Advantech WebAccess SQL Injection
41Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 7.5epss 19%
from disclosure to weapon0 days
Published on NVDApr 12
metasploitApr 8
exploitation probability
19%top 3% of all CVEs
observed exploitation
nono source reports it
An attacker using SQL injection may use arguments to construct queries
without proper sanitization. The DBVisitor.dll is exposed through SOAP
interfaces, and the exposed functions are vulnerable to SOAP injection.
This may allow unexpected SQL action and access to records in the table
of the software database or execution of arbitrary code.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Affected products
Advantech · WebAccess