CVE-2016-0854

Published: Jan 15, 2016Modified: May 6, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.

Affected (1)

Products: Advantech: Webaccess

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Advantech Webaccess	Up to 8.0

References (12)

http://www.rapid7.com/db/modules/exploit/windows/scada/advantech_webaccess_dashboard_file_upload

Source: ics-cert@hq.dhs.gov

http://www.zerodayinitiative.com/advisories/ZDI-16-127

Source: ics-cert@hq.dhs.gov

http://www.zerodayinitiative.com/advisories/ZDI-16-128

Source: ics-cert@hq.dhs.gov

http://www.zerodayinitiative.com/advisories/ZDI-16-129

Source: ics-cert@hq.dhs.gov

https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www.exploit-db.com/exploits/39735/

Source: ics-cert@hq.dhs.gov

Exploit

http://www.rapid7.com/db/modules/exploit/windows/scada/advantech_webaccess_dashboard_file_upload

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.zerodayinitiative.com/advisories/ZDI-16-127

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.zerodayinitiative.com/advisories/ZDI-16-128

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.zerodayinitiative.com/advisories/ZDI-16-129

Source: af854a3a-2127-422b-91ae-364da2661108

https://ics-cert.us-cert.gov/advisories/ICSA-16-014-01

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://www.exploit-db.com/exploits/39735/

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

Timeline

No history available yet.