CVE-2024-2453

Description

There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database.

Reserved 2024-03-14 | Published 2024-03-21 | Updated 2024-08-01 | Assigner icscert

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

9.1.5U
affected

Credits

CISA discovered a public proof of concept as authored by Prześlij Komentarz and reported it to Advantech. finder

References

www.cisa.gov/news-events/ics-advisories/icsa-24-081-01 government-resource

cve.org (CVE-2024-2453)

nvd.nist.gov (CVE-2024-2453)

Download JSON