CVE-2017-16728

Name of the Vulnerable Software and Affected Versions: Advantech WebAccess versions prior to 8.3

Description: An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess, which may allow an attacker to cause the program to use an invalid memory address, resulting in a program crash. The issue affects multiple functions, including SQLSetConnectOption, SQLFreeConnect, SQLExecute, SQLFetchScroll, SQLDescribeParam, SQLExecDirect, SQLSetEnvAttr, SQLConnect, SQLFreeEnv, SQLPrepare, SQLNumResultCols, SQLParamData, SQLDisconnect, SQLAllocStmt, SQLSetParam, SQLFetch, SQLFreeStmt, SQLCancel, SQLSetStmtAttr, and SQLPutData.

Recommendations: For Advantech WebAccess versions prior to 8.3, update to version 8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable functions until a patch is available. Avoid using the affected functions in the webvrpcs drawsrv module to minimize the risk of exploitation.