VARIoT IoT vulnerabilities database

The SSH module in the Integrated Management Controller (IMC) before 2.3.1 in Cisco Unified Computing System on E-Series blade servers allows remote attackers to cause a denial of service (IMC hang) via a crafted SSH packet, aka Bug ID CSCuo69206. Cisco Unified Computing System E-Series are prone to a remote denial-of-service vulnerability. Attackers can exploit this issue to cause the affected device to become unresponsive, denying service to legitimate users. This issue is being tracked by Cisco Bug ID CSCuo69206

Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not verify the integrity of downloaded updates, which allows remote attackers to execute arbitrary code via a Trojan horse update. Sensys Networks VSN240-F, VSN240-T sensors VDS and TrafficDOT are wireless traffic detection sensors from Sensys Networks, USA. Sensys Networks VSN240-F and VSN240-T sensors have security bypass vulnerabilities in versions prior to VDS 2.10.1 and versions prior to TrafficDOT 2.10.3. The program failed to verify the integrity of the download update. Multiple Sensys Networks Products are prone to a security-bypass vulnerability. Attackers can exploit this issue to bypass security restrictions and cause the system to download the modified code without sufficiently verifying the integrity of the code; this may aid in launching further attacks

Sensys Networks VSN240-F and VSN240-T sensors VDS before 2.10.1 and TrafficDOT before 2.10.3 do not use encryption, which allows remote attackers to interfere with traffic control by replaying transmissions on a wireless network. Sensys Networks VSN240-F and VSN240-T sensors have security vulnerabilities in versions prior to VDS 2.10.1 and versions prior to TrafficDOT 2.10.3. Because the program does not use encryption. Multiple Sensys Networks Products are prone to a security vulnerability that allows attackers to perform man-in-the-middle attacks. Remote attackers can exploit this issue to gain access to sensitive information through a man-in-the-middle attack. Successful exploits will lead to other attacks

SSL virtual servers in F5 BIG-IP systems 10.x before 10.2.4 HF9, 11.x before 11.2.1 HF12, 11.3.0 before HF10, 11.4.0 before HF8, 11.4.1 before HF5, 11.5.0 before HF5, and 11.5.1 before HF5, when used with third-party Secure Sockets Layer (SSL) accelerator cards, might allow remote attackers to have unspecified impact via a timing side-channel attack. plural F5 BIG-IP The product contains an information disclosure vulnerability.Information may be obtained. Multiple F5 Networks Products are prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information. Information obtained may lead to further attacks. F5 BIG-IP LTM, etc. LTM is a local traffic manager; APM is a solution that provides secure unified access to business-critical applications and networks. The following products and versions are affected: BIG-IP LTM version 11.0.0 to 11.5.1, version 10.0.0 to 10.2.4, BIG-IP AAM version 11.4.0 to 11.5.1, BIG-IP AFM 11.3 .0 to 11.5.1, BIG-IP Analytics 11.0.0 to 11.5.1, BIG-IP APM 11.0.0 to 11.5.1, 10.1.0 to 10.2.4, BIG-IP ASM 11.0.0 to 11.5.1, 10.0.0 to 10.2.4, BIG-IP Edge Gateway 11.0.0 to 11.3.0, 10.1.0 to 10.2.4, BIG-IP GTM Version 11.0.0 to Version 11.5.1, Version 10.0.0 to Version 10.2.4, BIG-IP Link Controller Version 11.0.0 to Version 11.5.1, Version 10.0.0 to Version 10.2.4, BIG-IP PEM 11.3 .0 to 11.5.1, BIG-IP PSM 11.0.0 to 11.4.1, 10.0.0 to 10.2.4, BIG-IP WebAccelerator 11.0.0 to 11.3.0, 10.0.0 Version to version 10.2.4, BIG-IP WOM version 11.0.0 to version 11.3.0, version 10.0.0 to version 10.2.4

Double free vulnerability in SAP Crystal Reports allows remote attackers to execute arbitrary code via crafted connection string record in an RPT file. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of RPT files. The issue lies in processing a connection string record. An attacker can leverage this vulnerability to execute code under the context of the current process. Failed exploit attempts will result in a denial-of-service condition

Stack-based buffer overflow in SAP Crystal Reports allows remote attackers to execute arbitrary code via a crafted data source string in an RPT file. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of RPT files. The issue lies in the processing of data source strings. An attacker can leverage this vulnerability to execute code under the context of the current process. Failed exploit attempts may result in a denial-of-service condition

The My nTelos (aka com.telespree.ntelospostpay) application 1.1.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. NOTE: nTelos Wireless has indicated that this vulnerability report is incorrect. ** Unsettled ** This case has not been confirmed as a vulnerability. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. There is a security vulnerability in version 1.1.2 of the Android My nTelos application

The Cisco Class Locator Fast Lane (aka com.tabletkings.mycompany.fastlane.cisco) application for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. Cisco is a network solution provider. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server

The Selfshot - Front Flash Camera (aka com.americos.selfshot) application 1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. Selfshot - Front Flash Camera (also known as com.americos.selfshot) application for Android is a mobile phone front camera camera application based on the Android platform. There is a security vulnerability in Android Selfshot - Front Flash Camera application version 1.1

The Cisco Technical Support (aka com.cisco.swtg_android) application 3.7.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. Cisco Technical Support (also known as com.cisco.swtg_android) application for Android is a set of technical support applications based on the Android platform of Cisco (Cisco). There is a security vulnerability in the Android Cisco Technical Support application version 3.7.1

The Selfie Camera -Facial Beauty- (aka com.cfinc.cunpic) application 1.2.7 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. Selfie Camera -Facial Beauty- (also known as com.cfinc.cunpic) application for Android is a set of applications based on the Android platform

The Cartoon Camera (aka com.fingersoft.cartooncamera) application 1.2.2 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. There is a security vulnerability in the version 1.2.2 of the Android Cartoon Camera application

The verizon (aka com.wverizonwirelessbill) application 0.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server

The Vendormate Mobile (aka com.vendormate.mobile) application 3.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. Vendormate Mobile for Android SSL is an Android platform based application. Vendormate Mobile for Android SSL has a security vulnerability. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server

The Mitsubishi Road Assist (aka com.agero.mitsubishi) application 1.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server

The DS audio (aka com.synology.DSaudio) application 3.4 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. There is a security vulnerability in version 3.4 of the Android DS audio application

The DS file (aka com.synology.DSfile) application 4.1.1 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. There is a security vulnerability in version 4.1.1 of the Android DS file application

The DS photo+ (aka com.synology.dsphoto) application 3.3 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. AppsGeyser Online Android A tool for creating applications. On the developer site, 2014 Year 12 Moon 22 As of the day 130 Over 10,000 Android Application AppsGeyser It is stated that it was created by. AppsGeyser Created with Android The application includes HTTPS In communication SSL Contains code to disable server certificate validation.AppsGeyser If you use an application created in Android A third party on the same network as the device may view or alter the communication content of the product. plural Android The app includes SSL A vulnerability exists that does not properly validate certificates. CERT/CC Then CERT Tapioca Was used to investigate this vulnerability. For details of the survey method, CERT/CC blog Please confirm. In addition, regarding this vulnerability, CERT Oracle Secure Coding Standard for Java of DRD19-J. Properly verify server certificate on SSL/TLS See also CERT Tapioca https://www.cert.org/vulnerability-analysis/tools/cert-tapioca.cfm CERT/CC blog https://www.cert.org/blogs/certcc/post.cfm?EntryID=204 DRD19-J. Properly verify server certificate on SSL/TLS https://www.securecoding.cert.org/confluence/x/CQAJCMan-in-the-middle attacks, although the impact depends on the behavior of the app (man-in-the-middle attack) By HTTPS Network traffic that should be protected by may be viewed or tampered with. As a result, authentication information may be obtained or arbitrary code may be executed. An attacker could use this vulnerability to perform a man-in-the-middle attack and impersonate a trusted server. There is a security vulnerability in version 3.3 of the Android DS photo+ application

Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter. Advantech WebAccess is an IE-based HMI/SCADA monitoring software that features all engineering projects, database setup, drawing and software management using a standard browser over the internet or intranet. A buffer overflow vulnerability exists in Advantech WebAccess. An attacker exploits a vulnerability to execute arbitrary code in the context of an affected application or to crash the entire application. Advantech WebAccess is prone to a stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer. Failed exploit attempts will likely cause a denial-of-service condition. Advantech WebAccess 7.2 is vulnerable; other versions may also be affected. Advantech WebAccess is a browser-based HMI/SCADA software developed by Advantech. The software supports dynamic graphic display and real-time data control, and provides functions of remote control and management of automation equipment. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech WebAccess Vulnerabilities 1. *Advisory Information* Title: Advantech WebAccess Vulnerabilities Advisory ID: CORE-2014-0005 Advisory URL: http://www.coresecurity.com/advisories/advantech-webaccess-vulnerabilities Date published: 2014-09-02 Date of last update: 2014-09-01 Vendors contacted: Advantech Release mode: User release 2. *Vulnerability Description* Advantech WebAccess [1] is a browser-based software package for human-machine interfaces HMI, and supervisory control and data acquisition SCADA. 4. WebAccess 7.2 . 5. *Non-vulnerable packages* . AdvantechWebAccessUSANode_20140730_3.4.3 6. *Vendor Information, Solutions and Workarounds* Advantech has addressed the vulnerability in WebAccess by issuing an update located at http://webaccess.advantech.com/downloads_software.php Given that this is a client-side vulnerability, affected users should avoid opening untrusted '.html' files. Core Security also recommends those affected use third party software such as Sentinel [4] or EMET [3] that could help to prevent the exploitation of affected systems to some extent. 7. *Credits* This vulnerability was discovered and researched by Ricardo Narvaja from Core Security Exploit Writers Team. Core Security Advisories Team would also like to thank ICS-CERT Coordination Center for their assistance during the vulnerability reporting process. 8. Below is shown the result of opening a malicious html file with a long NodeName parameter, an attacker can overflow the stack buffer mentioned above and overwrite the SEH (Structured Exception Handler), enabling arbitrary code execution on the machine. /----- EAX 03A39942 ASCII "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB..." ECX 0162B720 EDX 01630000 xpsp2res.01630000 EBX 0162B720 ESP 0162B454 EBP 0162B460 ESI 0162B4D8 EDI 03A31E98 EIP 064EA6D4 webvact.064EA6D4 -----/ /----- SEH chain of thread 000016CC Address SE handler 0162DB40 42424242 -----/ 9. *Report Timeline* . 2014-05-06: Core Security notifies Advantech of the vulnerability. Publication date is set for May 26th, 2014. 2014-05-09: CORE asks for a reply. 2014-05-26: First release date missed. 2014-05-26: Core Security notifies that the issues were reported 2 weeks ago and there was no reply since May 6th, 2014. 2014-05-29: Core Security contacts the ICS-CERT for assistance in order to coordinate the disclosure of the advisory. 2014-05-29: ICS-CERT acknowledges Core Security e-mail, and asks for a technical description of the vulnerability. 2014-05-29: Core Security sends technical details to the ICS-CERT. 2014-06-05: ICS-CERT team notifies that they have contacted the vendor and that they will notify us once the vendor has validated the vulnerabilities. 2014-06-18: ICS-CERT team notifies that the vendor is working in a new release, expected to be released in September, and ask if Core Security is interested in validating Advantech's vulnerability fix in their beta version. 2014-06-18: Core Security accepts the testing of the vendor beta version, but shares their concerns about waiting several months for fixes that are related to vulnerabilities already public. 2014-06-18: ICS-CERT notifies that they will let us know when they plan to make the beta version available for testing. 2014-07-03: ICS-CERT team notifies that the vendor is working to provide a download link for the beta version. 2014-07-08: ICS-CERT team sends download link provided by the vendor. 2014-07-10: Core Security confirms to ICS-CERT that the new version it's still vulnerable, and comments that after some analysis the vulnerable function doesn't has changes. 2014-07-10: ICS-CERT notifies that they will let the vendor know that that the vulnerabilities still exist. And asks to setup a teleconference between Core Security, the CERT and the vendor. 2014-07-10: Core Security notifies the ICS-CERT that all interactions are made via email only. 2014-07-10: ICS-CERT notifies they provided the information to the vendor. 2014-07-21: Core Security notifies the ICS-CERT that Tipping Point Zero Day Initiative has released several advisories[2] affecting the vendor including some that appears to be related to the one we are coordinating. 2014-07-21: ICS-CERT notifies that some of those advisories where in coordination with them, and that after a review of the link shared by Core Security are related to ICSA-14-198-02 and don't appear to be related to the reported vulnerability. 2014-07-21: Core Security notifies that ZDI-14-243 and ZDI-14-244 appears to be directly related. 2014-07-21: ICS-CERT is trying to contact Advantech to get a status update and their current plan for vulnerability remediation. 2014-08-07: ICS-CERT notifies that they contacted the vendor and they are waiting for an status update. 2014-08-21: Core Security contacts ICS-CERT since no reply was received in the past two weeks. 2014-08-21: ICS-CERT notifies that vendor representative stated that they are currently training a new product manager and they have not yet responded to the vulnerabilities we are discussing. 2014-08-28: Core Security notifies the ICS-CERT that the advisory publication is going to be scheduled for Monday 1st of September. 2014-08-28: ICS-CERT acknowledges Core Security e-mail. 2014-08-28: Core Security re-schedules the advisory publication for Sep 2nd, 2014. 2014-09-02: Core Security found out that the vendor released a silent fix on 30th of July. 2014-09-02: Core Security releases the advisory CORE-2014-0005 tagged as user-release. 10. *References* [1] http://webaccess.advantech.com/. [2] http://www.zerodayinitiative.com/advisories/published/. [3] http://support.microsoft.com/kb/2458544. [4] https://github.com/CoreSecurity/sentinel. 11. *About CoreLabs* CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. 12. *About Core Security Technologies* Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com. 13. *Disclaimer* The contents of this advisory are copyright (c) 2014 Core Security and (c) 2014 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/ 14. *PGP/GPG Keys* This advisory has been signed with the GPG key of Core Security advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc

Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the UserName parameter. Advantech WebAccess is an IE-based HMI/SCADA monitoring software that features all engineering projects, database setup, drawing and software management using a standard browser over the internet or intranet. A buffer overflow vulnerability exists in Advantech WebAccess. An attacker exploits a vulnerability to execute arbitrary code in the context of an affected application or to crash the entire application. Advantech WebAccess is prone to a stack-based buffer-overflow vulnerability because the application fails to properly bounds-check user-supplied data before copying it into an insufficiently sized buffer. Failed exploit attempts will likely cause a denial-of-service condition. Advantech WebAccess 7.2 is vulnerable; other versions may also be affected. Advantech WebAccess is a browser-based HMI/SCADA software developed by Advantech. The software supports dynamic graphic display and real-time data control, and provides functions of remote control and management of automation equipment. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/ Advantech WebAccess Vulnerabilities 1. *Advisory Information* Title: Advantech WebAccess Vulnerabilities Advisory ID: CORE-2014-0005 Advisory URL: http://www.coresecurity.com/advisories/advantech-webaccess-vulnerabilities Date published: 2014-09-02 Date of last update: 2014-09-01 Vendors contacted: Advantech Release mode: User release 2. *Vulnerability Description* Advantech WebAccess [1] is a browser-based software package for human-machine interfaces HMI, and supervisory control and data acquisition SCADA. 4. WebAccess 7.2 . 5. *Non-vulnerable packages* . AdvantechWebAccessUSANode_20140730_3.4.3 6. *Vendor Information, Solutions and Workarounds* Advantech has addressed the vulnerability in WebAccess by issuing an update located at http://webaccess.advantech.com/downloads_software.php Given that this is a client-side vulnerability, affected users should avoid opening untrusted '.html' files. Core Security also recommends those affected use third party software such as Sentinel [4] or EMET [3] that could help to prevent the exploitation of affected systems to some extent. 7. *Credits* This vulnerability was discovered and researched by Ricardo Narvaja from Core Security Exploit Writers Team. Core Security Advisories Team would also like to thank ICS-CERT Coordination Center for their assistance during the vulnerability reporting process. 8. Below is shown the result of opening a malicious html file with a long NodeName parameter, an attacker can overflow the stack buffer mentioned above and overwrite the SEH (Structured Exception Handler), enabling arbitrary code execution on the machine. /----- EAX 03A39942 ASCII "BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB..." ECX 0162B720 EDX 01630000 xpsp2res.01630000 EBX 0162B720 ESP 0162B454 EBP 0162B460 ESI 0162B4D8 EDI 03A31E98 EIP 064EA6D4 webvact.064EA6D4 -----/ /----- SEH chain of thread 000016CC Address SE handler 0162DB40 42424242 -----/ 9. *Report Timeline* . 2014-05-06: Core Security notifies Advantech of the vulnerability. Publication date is set for May 26th, 2014. 2014-05-09: CORE asks for a reply. 2014-05-26: First release date missed. 2014-05-26: Core Security notifies that the issues were reported 2 weeks ago and there was no reply since May 6th, 2014. 2014-05-29: Core Security contacts the ICS-CERT for assistance in order to coordinate the disclosure of the advisory. 2014-05-29: ICS-CERT acknowledges Core Security e-mail, and asks for a technical description of the vulnerability. 2014-05-29: Core Security sends technical details to the ICS-CERT. 2014-06-05: ICS-CERT team notifies that they have contacted the vendor and that they will notify us once the vendor has validated the vulnerabilities. 2014-06-18: ICS-CERT team notifies that the vendor is working in a new release, expected to be released in September, and ask if Core Security is interested in validating Advantech's vulnerability fix in their beta version. 2014-06-18: Core Security accepts the testing of the vendor beta version, but shares their concerns about waiting several months for fixes that are related to vulnerabilities already public. 2014-06-18: ICS-CERT notifies that they will let us know when they plan to make the beta version available for testing. 2014-07-03: ICS-CERT team notifies that the vendor is working to provide a download link for the beta version. 2014-07-08: ICS-CERT team sends download link provided by the vendor. 2014-07-10: Core Security confirms to ICS-CERT that the new version it's still vulnerable, and comments that after some analysis the vulnerable function doesn't has changes. 2014-07-10: ICS-CERT notifies that they will let the vendor know that that the vulnerabilities still exist. And asks to setup a teleconference between Core Security, the CERT and the vendor. 2014-07-10: Core Security notifies the ICS-CERT that all interactions are made via email only. 2014-07-10: ICS-CERT notifies they provided the information to the vendor. 2014-07-21: Core Security notifies the ICS-CERT that Tipping Point Zero Day Initiative has released several advisories[2] affecting the vendor including some that appears to be related to the one we are coordinating. 2014-07-21: ICS-CERT notifies that some of those advisories where in coordination with them, and that after a review of the link shared by Core Security are related to ICSA-14-198-02 and don't appear to be related to the reported vulnerability. 2014-07-21: Core Security notifies that ZDI-14-243 and ZDI-14-244 appears to be directly related. 2014-07-21: ICS-CERT is trying to contact Advantech to get a status update and their current plan for vulnerability remediation. 2014-08-07: ICS-CERT notifies that they contacted the vendor and they are waiting for an status update. 2014-08-21: Core Security contacts ICS-CERT since no reply was received in the past two weeks. 2014-08-21: ICS-CERT notifies that vendor representative stated that they are currently training a new product manager and they have not yet responded to the vulnerabilities we are discussing. 2014-08-28: Core Security notifies the ICS-CERT that the advisory publication is going to be scheduled for Monday 1st of September. 2014-08-28: ICS-CERT acknowledges Core Security e-mail. 2014-08-28: Core Security re-schedules the advisory publication for Sep 2nd, 2014. 2014-09-02: Core Security found out that the vendor released a silent fix on 30th of July. 2014-09-02: Core Security releases the advisory CORE-2014-0005 tagged as user-release. 10. *References* [1] http://webaccess.advantech.com/. [2] http://www.zerodayinitiative.com/advisories/published/. [3] http://support.microsoft.com/kb/2458544. [4] https://github.com/CoreSecurity/sentinel. 11. *About CoreLabs* CoreLabs, the research center of Core Security, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com. 12. *About Core Security Technologies* Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations. Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com. 13. *Disclaimer* The contents of this advisory are copyright (c) 2014 Core Security and (c) 2014 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/ 14. *PGP/GPG Keys* This advisory has been signed with the GPG key of Core Security advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc