Details of VAR-202004-0077

ID

VAR-202004-0077

CVE

CVE-2020-10617

TITLE

Advantech WebAccess/NMS DBUtil SQL Injection Information Disclosure Vulnerability

Trust: 8.4

sources: ZDI: ZDI-20-438 // ZDI: ZDI-20-439 // ZDI: ZDI-20-395 // ZDI: ZDI-20-416 // ZDI: ZDI-20-442 // ZDI: ZDI-20-427 // ZDI: ZDI-20-425 // ZDI: ZDI-20-415 // ZDI: ZDI-20-437 // ZDI: ZDI-20-435 // ZDI: ZDI-20-407 // ZDI: ZDI-20-417

DESCRIPTION

There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access to sensitive information. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech WebAccess/NMS. Authentication is not required to exploit this vulnerability.The specific flaw exists within the processing of calls to the getManagedDeviceByIP method of the DBUtil class. When parsing the deviceIP parameter of the upgBkpResults endpoint, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose files in the context of SYSTEM

Trust: 11.61

sources: NVD: CVE-2020-10617 // ZDI: ZDI-20-374 // ZDI: ZDI-20-417 // ZDI: ZDI-20-407 // ZDI: ZDI-20-435 // ZDI: ZDI-20-377 // ZDI: ZDI-20-437 // ZDI: ZDI-20-415 // ZDI: ZDI-20-445 // ZDI: ZDI-20-438 // ZDI: ZDI-20-425 // ZDI: ZDI-20-427 // ZDI: ZDI-20-442 // ZDI: ZDI-20-416 // ZDI: ZDI-20-395 // ZDI: ZDI-20-439 // ZDI: ZDI-20-412 // ZDI: ZDI-20-375

AFFECTED PRODUCTS

vendor:	advantech	model:	webaccess/nms	scope:	-	version:	-	Trust: 11.9
vendor:	advantech	model:	webaccess\/nms	scope:	lt	version:	3.0.2	Trust: 1.0

sources: ZDI: ZDI-20-438 // ZDI: ZDI-20-374 // ZDI: ZDI-20-412 // ZDI: ZDI-20-439 // ZDI: ZDI-20-395 // ZDI: ZDI-20-416 // ZDI: ZDI-20-442 // ZDI: ZDI-20-427 // ZDI: ZDI-20-425 // ZDI: ZDI-20-375 // ZDI: ZDI-20-445 // ZDI: ZDI-20-415 // ZDI: ZDI-20-437 // ZDI: ZDI-20-377 // ZDI: ZDI-20-435 // ZDI: ZDI-20-407 // ZDI: ZDI-20-417 // NVD: CVE-2020-10617

CVSS

SEVERITY

CVSSV2

CVSSV3

ZDI:	CVE-2020-10617
value:	HIGH
Trust: 11.9
nvd@nist.gov:	CVE-2020-10617
value:	HIGH
Trust: 1.0
CNNVD:	CNNVD-202004-397
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2020-10617
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.0

ZDI:	CVE-2020-10617
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.0
Trust: 11.9
nvd@nist.gov:	CVE-2020-10617
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0

PROBLEMTYPE DATA

problemtype:

CWE-89

Trust: 1.0

sources: NVD: CVE-2020-10617

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202004-397

TYPE

SQL injection

Trust: 0.6

sources: CNNVD: CNNVD-202004-397

PATCH

title:	Advantech has issued an update to correct this vulnerability.	url:	https://www.us-cert.gov/ics/advisories/icsa-20-098-01	Trust: 11.9
title:	Advantech WebAccess/NMS SQL Repair measures for injecting vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=113477	Trust: 0.6

EXTERNAL IDS

db:	NVD	id:	CVE-2020-10617	Trust: 13.5
db:	ICS CERT	id:	ICSA-20-098-01	Trust: 1.6
db:	ZDI	id:	ZDI-20-445	Trust: 1.3
db:	ZDI_CAN	id:	ZDI-CAN-9820	Trust: 0.7
db:	ZDI	id:	ZDI-20-438	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9567	Trust: 0.7
db:	ZDI	id:	ZDI-20-374	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9765	Trust: 0.7
db:	ZDI	id:	ZDI-20-412	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9821	Trust: 0.7
db:	ZDI	id:	ZDI-20-439	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9589	Trust: 0.7
db:	ZDI	id:	ZDI-20-395	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9776	Trust: 0.7
db:	ZDI	id:	ZDI-20-416	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9824	Trust: 0.7
db:	ZDI	id:	ZDI-20-442	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9806	Trust: 0.7
db:	ZDI	id:	ZDI-20-427	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9804	Trust: 0.7
db:	ZDI	id:	ZDI-20-425	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9568	Trust: 0.7
db:	ZDI	id:	ZDI-20-375	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9827	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9775	Trust: 0.7
db:	ZDI	id:	ZDI-20-415	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9819	Trust: 0.7
db:	ZDI	id:	ZDI-20-437	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9570	Trust: 0.7
db:	ZDI	id:	ZDI-20-377	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9817	Trust: 0.7
db:	ZDI	id:	ZDI-20-435	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9699	Trust: 0.7
db:	ZDI	id:	ZDI-20-407	Trust: 0.7
db:	ZDI_CAN	id:	ZDI-CAN-9777	Trust: 0.7
db:	ZDI	id:	ZDI-20-417	Trust: 0.7
db:	AUSCERT	id:	ESB-2020.1251	Trust: 0.6
db:	NSFOCUS	id:	46349	Trust: 0.6
db:	CNNVD	id:	CNNVD-202004-397	Trust: 0.6

REFERENCES

url:	https://www.us-cert.gov/ics/advisories/icsa-20-098-01	Trust: 13.5
url:	http://www.nsfocus.net/vulndb/46349	Trust: 0.6
url:	https://www.auscert.org.au/bulletins/esb-2020.1251/	Trust: 0.6
url:	https://www.zerodayinitiative.com/advisories/zdi-20-445/	Trust: 0.6
url:	https://nvd.nist.gov/vuln/detail/cve-2020-10617	Trust: 0.6

CREDITS

rgod of 9sg

Trust: 11.9

SOURCES

db:	ZDI	id:	ZDI-20-438
db:	ZDI	id:	ZDI-20-374
db:	ZDI	id:	ZDI-20-412
db:	ZDI	id:	ZDI-20-439
db:	ZDI	id:	ZDI-20-395
db:	ZDI	id:	ZDI-20-416
db:	ZDI	id:	ZDI-20-442
db:	ZDI	id:	ZDI-20-427
db:	ZDI	id:	ZDI-20-425
db:	ZDI	id:	ZDI-20-375
db:	ZDI	id:	ZDI-20-445
db:	ZDI	id:	ZDI-20-415
db:	ZDI	id:	ZDI-20-437
db:	ZDI	id:	ZDI-20-377
db:	ZDI	id:	ZDI-20-435
db:	ZDI	id:	ZDI-20-407
db:	ZDI	id:	ZDI-20-417
db:	CNNVD	id:	CNNVD-202004-397
db:	NVD	id:	CVE-2020-10617

LAST UPDATE DATE

2025-12-22T23:42:52.255000+00:00

SOURCES UPDATE DATE

db:	ZDI	id:	ZDI-20-438	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-374	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-412	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-439	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-395	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-416	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-442	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-427	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-425	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-375	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-445	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-415	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-437	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-377	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-435	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-407	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-417	date:	2020-04-08T00:00:00
db:	CNNVD	id:	CNNVD-202004-397	date:	2020-04-14T00:00:00
db:	NVD	id:	CVE-2020-10617	date:	2024-11-21T04:55:42.477

SOURCES RELEASE DATE

db:	ZDI	id:	ZDI-20-438	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-374	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-412	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-439	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-395	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-416	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-442	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-427	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-425	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-375	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-445	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-415	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-437	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-377	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-435	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-407	date:	2020-04-08T00:00:00
db:	ZDI	id:	ZDI-20-417	date:	2020-04-08T00:00:00
db:	CNNVD	id:	CNNVD-202004-397	date:	2020-04-07T00:00:00
db:	NVD	id:	CVE-2020-10617	date:	2020-04-09T14:15:12.510