[0day-rubbish] Advantech WebAccess Node 9.2.3 unauthenticated CrystalRpt.aspx file upload and path traversal to code execution in w3wp.exe (9.8)
Unauthenticated file upload and path traversal in Advantech WebAccess Node 9.2.3 can execute code, scored 9.8.
0day Rubbish Research Team disclosed an unauthenticated flaw in Advantech WebAccess Node 9.2.3, a closed-source industrial SCADA/HMI web server from Advantech in Taiwan. CrystalRpt.aspx allows unrestricted file upload combined with path traversal and performs no authorization check, leading to code execution in w3wp.exe. The issue maps to CWE-434, CWE-22, and CWE-306, with a stated score of 9.8; impact is higher if the IIS pool runs with elevated privileges. No CVE or observed exploitation is mentioned.
- Unauthenticated CrystalRpt.aspx upload and path traversal in WebAccess Node 9.2.3
- Leads to code execution inside w3wp.exe; stated score 9.8
- Page makes no authorization decision; CWE-434, CWE-22, and CWE-306
- Affects Advantech's industrial SCADA and HMI web server
- Vendors
- Advantech
- Products
- WebAccess Node
- Organizations
- 0day Rubbish Research Team
- Countries
- Taiwan
From the original article
Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in Advantech WebAccess Node 9. 2. 3, the closed-source industrial SCADA/HMI web server from Advantech (Taiwan).
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.