CVE-2016-0851

Vulnerability

Advantech WebAccess versions 8.0 and prior contain an out-of-bounds memory access vulnerability (CWE-788) that can be triggered remotely. The software reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer, leading to a denial-of-service condition [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by sending specially crafted requests to the WebAccess application. The exact vectors are unspecified, but the advisory confirms remote exploitation is possible without prior authentication [1].

Impact

Successful exploitation causes the application to crash or become unresponsive, resulting in a denial of service. This can disrupt SCADA and HMI operations in affected environments [1].

Mitigation

Advantech released WebAccess version 8.1 to address this vulnerability. Users should upgrade to version 8.1 or later. ICS-CERT recommends applying the update and following security best practices for industrial control systems [1].