CVE-2019-10985

Name of the Vulnerable Software and Affected Versions Advantech WebAccess versions 8.3.5 and prior

Description The issue is caused by a lack of proper validation of a user-supplied path prior to use in file operations, allowing an attacker to delete files while posing as an administrator. This can be exploited by a remote attacker to delete files.

Recommendations For versions 8.3.5 and prior, consider restricting access to file operations until a patch is available. As a temporary workaround, limit the privileges of users who can perform file operations to minimize the risk of exploitation.