CVE-2016-0852

Vulnerability

Advantech WebAccess versions 8.0 and prior contain a vulnerability that allows remote attackers to bypass an intended administrative requirement and obtain file or folder access. The exact mechanism is unspecified, but the flaw resides in the web-based SCADA/HMI application's access control logic. [1]

Exploitation

An attacker can exploit this vulnerability remotely without any prior authentication or user interaction. By sending specially crafted requests to the WebAccess server, the attacker can bypass administrative checks and gain unauthorized access to files and folders. [1]

Impact

Successful exploitation enables an attacker to read arbitrary files and folders on the target system, potentially exposing sensitive configuration data, credentials, or other critical information. The attacker does not require any special privileges. [1]

Mitigation

Advantech has released WebAccess version 8.1 to address this vulnerability. Users should upgrade to version 8.1 or later. No workarounds are documented. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. [1]