- Description
- The CreateProcess method in the BWOCXRUN.BwocxrunCtrl.1 ActiveX control in bwocxrun.ocx in Advantech WebAccess before 7.2 allows remote attackers to execute (1) setup.exe, (2) bwvbprt.exe, and (3) bwvbprtl.exe programs from arbitrary pathnames via a crafted argument, as demonstrated by a UNC share pathname.
- Source
- ics-cert@hq.dhs.gov
- NVD status
- Modified
CVSS 2.0
- Type
- Primary
- Base score
- 7.5
- Impact score
- 6.4
- Exploitability score
- 10
- Vector string
- AV:N/AC:L/Au:N/C:P/I:P/A:P
- Hype score
- Not currently trending
- Comment
- CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
- Impact
- -
- Solution
- -
[
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:advantech:advantech_webaccess:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3D097D1E-9A02-40B0-93BD-163A11638118",
"versionEndIncluding": "7.1"
},
{
"criteria": "cpe:2.3:a:advantech:advantech_webaccess:5.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "090C819C-5964-4158-80E6-2D4751A5E8BF"
},
{
"criteria": "cpe:2.3:a:advantech:advantech_webaccess:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7CF61F9C-360A-4B70-951D-8EE9CF6E55FA"
},
{
"criteria": "cpe:2.3:a:advantech:advantech_webaccess:7.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1082E1D5-AF49-431F-9172-98C2D2887C96"
}
],
"operator": "OR"
}
]
}
]