Vulnerabilidades em Advantech

191 resultados
Análise Vexday

Com 142 CVEs catalogadas, o portfólio da Advantech apresenta 21 vulnerabilidades de severidade crítica e 4 com prova de conceito pública disponível, o que representa superfície de ataque concreta para agentes com capacidade de exploração. A taxa de exploração ativa está abaixo da média geral do catálogo, com zero registros no CISA KEV, embora esse dado não elimine o risco, especialmente considerando que CVE-2014-2364 — a vulnerabilidade de maior destaque ativo — registra escore EPSS de 0,6138, indicando probabilidade relevante de exploração. A falha mais recorrente por tipo é CWE-89 (injeção de SQL), uma classe de vulnerabilidade bem documentada e com técnicas de exploração amplamente conhecidas, o que reforça a necessidade de atenção redobrada em ambientes que dependem de componentes Advantech expostos a redes. Equipes de segurança devem priorizar a revisão das vulnerabilidades críticas com PoC pública, particularmente em instalações de tecnologia operacional onde a janela de correção tende a ser mais restrita.

CVE-2026-43853HIGHA vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.EPSS 0.4%CVE-2026-43838CRITICALA stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code execution.EPSS 0.4%CVE-2026-6888HIGHSQL Injection VulnerabilityEPSS 0.4%CVE-2024-37187MEDIUMAdvantech ADAM-5550 Weak Encoding for PasswordEPSS 0.4%CVE-2026-43834HIGHA stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to achieve code executiEPSS 0.4%CVE-2018-8841—In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prioEPSS 0.4%CVE-2025-53509HIGHAdvantech iView Argument InjectionEPSS 0.3%CVE-2026-43839HIGHA NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker to crash the service.EPSS 0.3%CVE-2026-43842MEDIUMA NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via theEPSS 0.3%CVE-2026-43843MEDIUMAn integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the service.EPSS 0.3%CVE-2026-43841MEDIUMA NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via theEPSS 0.3%CVE-2026-43848MEDIUMA vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the service.EPSS 0.3%CVE-2026-43840MEDIUMA NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via theEPSS 0.3%CVE-2025-46268MEDIUMAdvantech WebAccess/SCADA SQL InjectionEPSS 0.3%CVE-2025-52459HIGHAdvantech iView Argument InjectionEPSS 0.3%CVE-2025-48891HIGHAdvantech iView SQL InjectionEPSS 0.3%CVE-2025-34247MEDIUMAdvantech WebAccess/VPN < 1.1.5 SQL Injection via NetworksController.addNetworkAction()EPSS 0.3%CVE-2025-34242HIGHAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxNetworkController.ajaxAction()EPSS 0.3%CVE-2025-34241MEDIUMAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxDeviceController.ajaxDeviceAction()EPSS 0.3%CVE-2025-34246MEDIUMAdvantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxPrevalidationController.ajaxAction()EPSS 0.3%