CVE-2020-12002

high-risk

Published 2020-05-08

Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution.

Do I need to act?

31.5% chance of exploitation in next 30 days

EPSS score — higher than 69% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (2)

Webaccess

Affected Vendors

Advantech

References (20)

Third Party Advisory https://www.us-cert.gov/ics/advisories/icsa-20-128-01

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-20-590/

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-20-591/

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-20-592/

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-20-619/

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-20-622/

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-20-624/

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-20-625/

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-20-633/

Third Party Advisory https://www.zerodayinitiative.com/advisories/ZDI-20-634/