CVE-2018-8841

Vulnerability

In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an improper privilege management vulnerability exists [1]. The flaw allows an authenticated user to modify files even though the intended access control only grants read permissions to that user [1].

Exploitation

An attacker must be an authenticated user of the affected WebAccess system [1]. No special privileges beyond authentication are mentioned as a prerequisite. The attacker can exploit this by leveraging the insufficient separation between read and write permissions, specifically targeting files that should be read-only [1]. The exact sequence of steps is not detailed in the available references, but the vulnerability is remotely exploitable and requires low skill to exploit [1].

Impact

Successful exploitation enables the attacker to modify files on the host system [1]. This could lead to data integrity loss, and depending on the nature of the files modified, may allow the attacker to execute arbitrary code or cause further compromise of the system [1]. The CVSS v3 base score of 9.8 indicates critical severity, with the potential for high impact on confidentiality, integrity, and availability [1].

Mitigation

The advisory recommends updating to the latest versions of the affected products [1]. Specific fixed versions for each product line should be obtained from Advantech. As of the publication date (2018-05-15), users are advised to apply vendor-provided patches or upgrades [1]. No workaround is described in the available references.