CVE-2020-12018

Name of the Vulnerable Software and Affected Versions Advantech WebAccess Node versions 8.4.4 and prior Advantech WebAccess Node version 9.0.0

Description An out-of-bounds vulnerability exists that may allow access to unauthorized data. This issue affects the WebAccess/SCADA system, specifically the DrawSrv and ViewSrv components, which can be exploited through the IOCTL 0x00002722, leading to an out-of-bounds read information disclosure.

Recommendations For Advantech WebAccess Node versions 8.4.4 and prior, update to a version later than 8.4.4 to resolve the issue. For Advantech WebAccess Node version 9.0.0, consider disabling the DrawSrv and ViewSrv components as a temporary workaround until a patch is available. Restrict access to the IOCTL 0x00002722 to minimize the risk of exploitation.