Sign-up

ID

VAR-201804-1566


CVE

CVE-2018-8833


TITLE

Advantech WebAccess HMI Designer Buffer error vulnerability

Trust: 1.4

sources: JVNDB: JVNDB-2018-004463 // CNNVD: CNNVD-201804-1423

DESCRIPTION

Heap-based buffer overflow vulnerabilities in Advantech WebAccess HMI Designer 2.1.7.32 and prior caused by processing specially crafted .pm3 files may allow remote code execution. Advantech WebAccess HMI Designer Contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Advantech WebAccess HMI Designer is a Human Machine Interface (HMI) runtime development software. Advantech WebAccess HMI Designer is prone to the following security vulnerabilities: 1. Multiple heap-based buffer-overflow vulnerabilities. 2. Multiple remote-code execution vulnerabilities. An attacker can exploit these issues to execute arbitrary code in the context of the application, or cause a denial-of-service condition. Advantech WebAccess HMI Designer, version 2.1.7.32 and prior are vulnerable. The product has functions such as data transmission, menu editing and text editing. A heap-based buffer error vulnerability exists in Advantech WebAccess HMI Designer 2.1.7.32 and earlier versions

Trust: 2.7

sources: NVD: CVE-2018-8833 // JVNDB: JVNDB-2018-004463 // CNVD: CNVD-2018-08458 // BID: 103972 // IVD: e2ed63b0-39ab-11e9-bb5e-000c29342cb1 // VULHUB: VHN-138865

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: e2ed63b0-39ab-11e9-bb5e-000c29342cb1 // CNVD: CNVD-2018-08458

AFFECTED PRODUCTS

vendor:advantechmodel:webaccess hmi designerscope:lteversion:2.1.7.32

Trust: 1.0

vendor:advantechmodel:webaccess/hmiscope:lteversion:2.1.7.32

Trust: 0.8

vendor:advantechmodel:webaccess hmi designerscope:lteversion:<=2.1.7.32

Trust: 0.6

vendor:advantechmodel:webaccess hmi designerscope:eqversion:2.1.7.32

Trust: 0.6

vendor:advantechmodel:webaccess/hmi designerscope:eqversion:2.1.7.32

Trust: 0.3

vendor:webaccess hmi designermodel: - scope:eqversion:*

Trust: 0.2

sources: IVD: e2ed63b0-39ab-11e9-bb5e-000c29342cb1 // CNVD: CNVD-2018-08458 // BID: 103972 // JVNDB: JVNDB-2018-004463 // CNNVD: CNNVD-201804-1423 // NVD: CVE-2018-8833

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-8833
value: HIGH

Trust: 1.0

NVD: CVE-2018-8833
value: HIGH

Trust: 0.8

CNVD: CNVD-2018-08458
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201804-1423
value: HIGH

Trust: 0.6

IVD: e2ed63b0-39ab-11e9-bb5e-000c29342cb1
value: HIGH

Trust: 0.2

VULHUB: VHN-138865
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-8833
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2018-08458
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: e2ed63b0-39ab-11e9-bb5e-000c29342cb1
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-138865
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-8833
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2018-8833
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: IVD: e2ed63b0-39ab-11e9-bb5e-000c29342cb1 // CNVD: CNVD-2018-08458 // VULHUB: VHN-138865 // JVNDB: JVNDB-2018-004463 // CNNVD: CNNVD-201804-1423 // NVD: CVE-2018-8833

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.1

problemtype:CWE-122

Trust: 1.0

problemtype:CWE-119

Trust: 0.9

sources: VULHUB: VHN-138865 // JVNDB: JVNDB-2018-004463 // NVD: CVE-2018-8833

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201804-1423

TYPE

Buffer error

Trust: 0.8

sources: IVD: e2ed63b0-39ab-11e9-bb5e-000c29342cb1 // CNNVD: CNNVD-201804-1423

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-004463

PATCH
title:トップページurl:http://www.advantech.co.jp/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2018-004463

EXTERNAL IDS
db:NVDid:CVE-2018-8833
Trust: 3.6
db:ICS CERTid:ICSA-18-114-03
Trust: 3.4
db:BIDid:103972
Trust: 2.0
db:CNVDid:CNVD-2018-08458
Trust: 0.8
db:CNNVDid:CNNVD-201804-1423
Trust: 0.8
db:JVNDBid:JVNDB-2018-004463
Trust: 0.8
db:IVDid:E2ED63B0-39AB-11E9-BB5E-000C29342CB1
Trust: 0.2
db:VULHUBid:VHN-138865
Trust: 0.1
sources:
            
            
            IVD: e2ed63b0-39ab-11e9-bb5e-000c29342cb1 // 
            
            
            
            CNVD: CNVD-2018-08458 // 
            
            
            
            VULHUB: VHN-138865 // 
            
            
            
            BID: 103972 // 
            
            
            
            JVNDB: JVNDB-2018-004463 // 
            
            
            
            CNNVD: CNNVD-201804-1423 // 
            
            
            
            NVD: CVE-2018-8833

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-18-114-03
Trust: 3.4
url:http://www.securityfocus.com/bid/103972
Trust: 1.7
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-8833
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-8833
Trust: 0.8
url:http://webaccess.advantech.com
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2018-08458 // 
            
            
            
            VULHUB: VHN-138865 // 
            
            
            
            BID: 103972 // 
            
            
            
            JVNDB: JVNDB-2018-004463 // 
            
            
            
            CNNVD: CNNVD-201804-1423 // 
            
            
            
            NVD: CVE-2018-8833

CREDITS
Steven Seeley of Source Incite working with Trend Micro??s Zero Day Initiative
Trust: 0.3
sources:
            
            
            BID: 103972

SOURCES
db:IVDid:e2ed63b0-39ab-11e9-bb5e-000c29342cb1
db:CNVDid:CNVD-2018-08458
db:VULHUBid:VHN-138865
db:BIDid:103972
db:JVNDBid:JVNDB-2018-004463
db:CNNVDid:CNNVD-201804-1423
db:NVDid:CVE-2018-8833

LAST UPDATE DATE
2024-11-23T21:38:59.720000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2018-08458date:2018-04-26T00:00:00
db:VULHUBid:VHN-138865date:2020-09-29T00:00:00
db:BIDid:103972date:2018-04-24T00:00:00
db:JVNDBid:JVNDB-2018-004463date:2018-06-20T00:00:00
db:CNNVDid:CNNVD-201804-1423date:2020-09-30T00:00:00
db:NVDid:CVE-2018-8833date:2024-11-21T04:14:24.793

SOURCES RELEASE DATE
db:IVDid:e2ed63b0-39ab-11e9-bb5e-000c29342cb1date:2018-04-26T00:00:00
db:CNVDid:CNVD-2018-08458date:2018-04-26T00:00:00
db:VULHUBid:VHN-138865date:2018-04-25T00:00:00
db:BIDid:103972date:2018-04-24T00:00:00
db:JVNDBid:JVNDB-2018-004463date:2018-06-20T00:00:00
db:CNNVDid:CNNVD-201804-1423date:2018-04-26T00:00:00
db:NVDid:CVE-2018-8833date:2018-04-25T23:29:00.247