CVE-2020-16207

Vulnerability

Advantech WebAccess HMI Designer versions 2.1.9.31 and prior contain multiple heap-based buffer overflow vulnerabilities (CWE-122) [1]. The flaws reside in the parsing of specially crafted PM3 project files where user-supplied data is copied into a fixed-length heap-based buffer without proper validation [2][3][4]. Affected product: WebAccess HMI Designer Versions 2.1.9.31 and prior [1].

Exploitation

An attacker can exploit these vulnerabilities by convincing a user to open a malicious PM3 file, for example by visiting a compromised web page or opening a malicious attachment [2][3][4]. The attack is local (AV:L) but requires user interaction (UI:R). No authentication is needed (PR:N). The low attack complexity (AC:L) means it is achievable with minimal skill [1].

Impact

Successful exploitation allows an attacker to execute arbitrary code in the context of the current process, read or modify information, or cause the application to crash [1][2][3][4]. The CVSS base score is 7.8 (High) with confidentiality, integrity, and availability all rated high [1][2].

Mitigation

Advantech has not released an updated version that fixes CVE-2020-16207 as of the publication date of the references (August 2020) [1]. Users are advised to follow CISA recommendations, including restricting access to the HMI Designer software and avoiding opening untrusted project files. No workaround is provided in the available references [1].