← back
CVE-2016-0854

CVE-2016-0854

EPSS 77.1%
Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.
Affected products
n/a · n/a
public PoCs found — 2
cve_referencewww.exploit-db.com/exploits/39735/unverifiedexploitdbwww.exploit-db.com/exploits/39735unverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →
References
https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01https://www.exploit-db.com/exploits/39735/http://www.rapid7.com/db/modules/exploit/windows/scada/advantech_webaccess_dashboard_file_uploadhttp://www.zerodayinitiative.com/advisories/ZDI-16-127http://www.zerodayinitiative.com/advisories/ZDI-16-128http://www.zerodayinitiative.com/advisories/ZDI-16-129