{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T20:23:21.684Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "WebAccess/SCADA",
               vendor: "Advantech",
               versions: [
                  {
                     status: "affected",
                     version: "Versions 8.3.5 and prior.",
                  },
               ],
            },
         ],
         datePublic: "2019-04-02T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Advantech WebAccess/SCADA, Versions 8.3.5 and prior. An improper access control vulnerability may allow an attacker to cause a denial-of-service condition.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-284",
                     description: "IMPROPER ACCESS CONTROL CWE-284",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-04-05T18:15:35",
            orgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
            shortName: "icscert",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "ics-cert@hq.dhs.gov",
               ID: "CVE-2019-6554",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "WebAccess/SCADA",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Versions 8.3.5 and prior.",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Advantech",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Advantech WebAccess/SCADA, Versions 8.3.5 and prior. An improper access control vulnerability may allow an attacker to cause a denial-of-service condition.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "IMPROPER ACCESS CONTROL CWE-284",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01",
                     refsource: "MISC",
                     url: "https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
      assignerShortName: "icscert",
      cveId: "CVE-2019-6554",
      datePublished: "2019-04-05T18:15:35",
      dateReserved: "2019-01-22T00:00:00",
      dateUpdated: "2024-08-04T20:23:21.684Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T15:25:36.755Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-01",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-32628",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-01-08T14:22:24.832377Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-01-08T14:22:34.205Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "WebAccess/SCADA",
               vendor: "Advantech",
               versions: [
                  {
                     lessThanOrEqual: "v9.1.3",
                     status: "affected",
                     version: "0",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               user: "00000000-0000-4000-9000-000000000000",
               value: "YangLiu from Elex Feigong Research Institute reported these vulnerabilities to CISA.",
            },
         ],
         datePublic: "2023-06-01T17:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of a certificate file to ASP when uploading it, which can lead to remote code execution.</span>\n\n</span>\n\n</span>\n\n",
                  },
               ],
               value: "\n\n\n\n\nIn Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of a certificate file to ASP when uploading it, which can lead to remote code execution.\n\n\n\n\n\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.2,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-434",
                     description: "CWE-434 Unrestricted Upload of File with Dangerous Type",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-06-05T23:14:00.388Z",
            orgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
            shortName: "icscert",
         },
         references: [
            {
               url: "https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-01",
            },
         ],
         solutions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Advantech recommends WebAccess/SCADA users upgrade to </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.advantech.com/en/support/details/installation?id=1-MS9MJV\">v9.1.4</a><span style=\"background-color: rgb(255, 255, 255);\">. </span>\n\n<br>",
                  },
               ],
               value: "\nAdvantech recommends WebAccess/SCADA users upgrade to  v9.1.4 https://www.advantech.com/en/support/details/installation . \n\n\n",
            },
         ],
         source: {
            advisory: "ICSA-23-152-01",
            discovery: "EXTERNAL",
         },
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
      assignerShortName: "icscert",
      cveId: "CVE-2023-32628",
      datePublished: "2023-06-05T23:14:00.388Z",
      dateReserved: "2023-05-22T18:07:54.479Z",
      dateUpdated: "2025-01-08T14:22:34.205Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T05:49:11.643Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-02",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "WebAccess/SCADA",
               vendor: "Advantech",
               versions: [
                  {
                     lessThan: "9.1.4",
                     status: "affected",
                     version: "0",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               user: "00000000-0000-4000-9000-000000000000",
               value: "Florent Saudel",
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "<p>All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute commands and overwrite files.</p>",
                  },
               ],
               value: "All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute commands and overwrite files.\n\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-822",
                     description: "CWE-822 Untrusted Pointer Dereference",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-10-11T14:34:24.399Z",
            orgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
            shortName: "icscert",
         },
         references: [
            {
               url: "https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-02",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         title: "CVE-2023-1437",
         x_generator: {
            engine: "VINCE 2.1.3",
            env: "prod",
            origin: "https://cveawg.mitre.org/api/cve/CVE-2023-1437",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
      assignerShortName: "icscert",
      cveId: "CVE-2023-1437",
      datePublished: "2023-08-02T22:30:43.978Z",
      dateReserved: "2023-03-16T22:01:32.632Z",
      dateUpdated: "2024-08-02T05:49:11.643Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T19:26:27.639Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.tenable.com/security/research/tra-2019-41",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "WebAccess/SCADA",
               vendor: "Advantech",
               versions: [
                  {
                     status: "affected",
                     version: "8.4.1",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Unauthenticated Remote Stack Buffer Overflow",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-09-10T15:55:33",
            orgId: "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
            shortName: "tenable",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.tenable.com/security/research/tra-2019-41",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "vulnreport@tenable.com",
               ID: "CVE-2019-3975",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "WebAccess/SCADA",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "8.4.1",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Advantech",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Unauthenticated Remote Stack Buffer Overflow",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.tenable.com/security/research/tra-2019-41",
                     refsource: "MISC",
                     url: "https://www.tenable.com/security/research/tra-2019-41",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "5ac1ecc2-367a-4d16-a0b2-35d495ddd0be",
      assignerShortName: "tenable",
      cveId: "CVE-2019-3975",
      datePublished: "2019-09-10T15:55:33",
      dateReserved: "2019-01-03T00:00:00",
      dateUpdated: "2024-08-04T19:26:27.639Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-2453",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-07-08T15:03:48.290308Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-07-08T19:52:58.826Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-01T19:11:53.526Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "government-resource",
                     "x_transferred",
                  ],
                  url: "https://www.cisa.gov/news-events/ics-advisories/icsa-24-081-01",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "WebAccess/SCADA",
               vendor: "Advantech",
               versions: [
                  {
                     status: "affected",
                     version: "9.1.5U",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               value: "CISA discovered a public proof of concept as authored by Prześlij Komentarz and reported it to Advantech.",
            },
         ],
         datePublic: "2024-03-21T21:23:00.000Z",
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\n<span style=\"background-color: rgb(255, 255, 255);\">There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database.</span>\n\n",
                  },
               ],
               value: "\nThere is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database.\n\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "NONE",
                  baseScore: 6.4,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  integrityImpact: "LOW",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-89",
                     description: "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-03-21T22:39:38.185Z",
            orgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
            shortName: "icscert",
         },
         references: [
            {
               tags: [
                  "government-resource",
               ],
               url: "https://www.cisa.gov/news-events/ics-advisories/icsa-24-081-01",
            },
         ],
         solutions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Advantech recommends updating WebAccess/SCADA to version 9.1.6 or higher to mitigate this vulnerability.</span>\n\n<br>",
                  },
               ],
               value: "\nAdvantech recommends updating WebAccess/SCADA to version 9.1.6 or higher to mitigate this vulnerability.\n\n",
            },
         ],
         source: {
            advisory: "ICSA-24-081-01",
            discovery: "EXTERNAL",
         },
         title: "Advantech WebAccess/SCADA SQL Injection",
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
      assignerShortName: "icscert",
      cveId: "CVE-2024-2453",
      datePublished: "2024-03-21T22:39:15.488Z",
      dateReserved: "2024-03-14T15:12:14.027Z",
      dateUpdated: "2024-08-01T19:11:53.526Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T20:23:21.543Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.zerodayinitiative.com/advisories/ZDI-19-585/",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "WebAccess/SCADA",
               vendor: "Advantech",
               versions: [
                  {
                     status: "affected",
                     version: "Versions 8.3.5 and prior.",
                  },
               ],
            },
         ],
         datePublic: "2019-04-02T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code execution.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-121",
                     description: "STACK-BASED BUFFER OVERFLOW CWE-121",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-07-02T16:06:07",
            orgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
            shortName: "icscert",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.zerodayinitiative.com/advisories/ZDI-19-585/",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "ics-cert@hq.dhs.gov",
               ID: "CVE-2019-6550",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "WebAccess/SCADA",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Versions 8.3.5 and prior.",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Advantech",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code execution.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "STACK-BASED BUFFER OVERFLOW CWE-121",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01",
                     refsource: "MISC",
                     url: "https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01",
                  },
                  {
                     name: "https://www.zerodayinitiative.com/advisories/ZDI-19-585/",
                     refsource: "MISC",
                     url: "https://www.zerodayinitiative.com/advisories/ZDI-19-585/",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
      assignerShortName: "icscert",
      cveId: "CVE-2019-6550",
      datePublished: "2019-04-05T18:09:34",
      dateReserved: "2019-01-22T00:00:00",
      dateUpdated: "2024-08-04T20:23:21.543Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T20:23:22.066Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "WebAccess/SCADA",
               vendor: "Advantech",
               versions: [
                  {
                     status: "affected",
                     version: "Versions 8.3.5 and prior.",
                  },
               ],
            },
         ],
         datePublic: "2019-04-02T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, may allow remote code execution.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-77",
                     description: "IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN A COMMAND ('COMMAND INJECTION') CWE-77",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2019-04-05T18:02:39",
            orgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
            shortName: "icscert",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "ics-cert@hq.dhs.gov",
               ID: "CVE-2019-6552",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "WebAccess/SCADA",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Versions 8.3.5 and prior.",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Advantech",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, may allow remote code execution.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN A COMMAND ('COMMAND INJECTION') CWE-77",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01",
                     refsource: "MISC",
                     url: "https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
      assignerShortName: "icscert",
      cveId: "CVE-2019-6552",
      datePublished: "2019-04-05T18:02:39",
      dateReserved: "2019-01-22T00:00:00",
      dateUpdated: "2024-08-04T20:23:22.066Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T10:13:48.320Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-01",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-22450",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-01-08T14:21:03.532091Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-01-08T14:21:41.605Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "WebAccess/SCADA",
               vendor: "Advantech",
               versions: [
                  {
                     lessThanOrEqual: "v9.1.3",
                     status: "affected",
                     version: "0",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               user: "00000000-0000-4000-9000-000000000000",
               value: "YangLiu from Elex Feigong Research Institute reported these vulnerabilities to CISA.",
            },
         ],
         datePublic: "2023-06-01T17:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\n<span style=\"background-color: rgb(255, 255, 255);\">\n\n<span style=\"background-color: rgb(255, 255, 255);\">In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an ASP script file to a webserver when logged in as manager user, which can lead to arbitrary code execution.</span>\n\n</span>\n\n",
                  },
               ],
               value: "\n\n\nIn Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to upload an ASP script file to a webserver when logged in as manager user, which can lead to arbitrary code execution.\n\n\n\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.2,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-434",
                     description: "CWE-434 Unrestricted Upload of File with Dangerous Type",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-06-05T23:17:47.003Z",
            orgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
            shortName: "icscert",
         },
         references: [
            {
               url: "https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-01",
            },
         ],
         solutions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Advantech recommends WebAccess/SCADA users upgrade to </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.advantech.com/en/support/details/installation?id=1-MS9MJV\">v9.1.4</a><span style=\"background-color: rgb(255, 255, 255);\">. </span>\n\n<br>",
                  },
               ],
               value: "\nAdvantech recommends WebAccess/SCADA users upgrade to  v9.1.4 https://www.advantech.com/en/support/details/installation . \n\n\n",
            },
         ],
         source: {
            advisory: "ICSA-23-152-01",
            discovery: "EXTERNAL",
         },
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
      assignerShortName: "icscert",
      cveId: "CVE-2023-22450",
      datePublished: "2023-06-05T23:17:47.003Z",
      dateReserved: "2023-05-22T18:07:54.484Z",
      dateUpdated: "2025-01-08T14:21:41.605Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T15:18:37.624Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-01",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-32540",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-01-08T14:22:05.299928Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-01-08T14:22:14.896Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "WebAccess/SCADA",
               vendor: "Advantech",
               versions: [
                  {
                     lessThanOrEqual: "v9.1.3",
                     status: "affected",
                     version: "0",
                     versionType: "custom",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               user: "00000000-0000-4000-9000-000000000000",
               value: "YangLiu from Elex Feigong Research Institute reported these vulnerabilities to CISA.",
            },
         ],
         datePublic: "2023-06-01T17:00:00.000Z",
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\n<span style=\"background-color: rgb(255, 255, 255);\">In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the operating system (including system files), inject code into an XLS file, and modify the file extension, which could lead to arbitrary code execution.</span>\n\n",
                  },
               ],
               value: "\nIn Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the operating system (including system files), inject code into an XLS file, and modify the file extension, which could lead to arbitrary code execution.\n\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  availabilityImpact: "HIGH",
                  baseScore: 7.2,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "HIGH",
                  scope: "UNCHANGED",
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-94",
                     description: "CWE-94 Improper Control of Generation of Code ('Code Injection')",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-06-05T23:16:28.045Z",
            orgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
            shortName: "icscert",
         },
         references: [
            {
               url: "https://www.cisa.gov/news-events/ics-advisories/icsa-23-152-01",
            },
         ],
         solutions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Advantech recommends WebAccess/SCADA users upgrade to </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.advantech.com/en/support/details/installation?id=1-MS9MJV\">v9.1.4</a><span style=\"background-color: rgb(255, 255, 255);\">. </span>\n\n<br>",
                  },
               ],
               value: "\nAdvantech recommends WebAccess/SCADA users upgrade to  v9.1.4 https://www.advantech.com/en/support/details/installation . \n\n\n",
            },
         ],
         source: {
            advisory: "ICSA-23-152-01",
            discovery: "EXTERNAL",
         },
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
      assignerShortName: "icscert",
      cveId: "CVE-2023-32540",
      datePublished: "2023-06-05T23:16:28.045Z",
      dateReserved: "2023-05-22T18:07:54.491Z",
      dateUpdated: "2025-01-08T14:22:14.896Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-02T06:33:06.094Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://www.cisa.gov/news-events/ics-advisories/icsa-23-150-01",
               },
            ],
            title: "CVE Program Container",
         },
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2023-2866",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2025-01-16T21:20:42.928189Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2025-01-16T21:32:10.686Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "WebAccess/SCADA",
               vendor: "Advantech",
               versions: [
                  {
                     status: "affected",
                     version: "8.4.5",
                  },
               ],
            },
         ],
         credits: [
            {
               lang: "en",
               type: "finder",
               user: "00000000-0000-4000-9000-000000000000",
               value: "Marlon Luis Petry reported this vulnerability to CISA.",
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\n<span style=\"background-color: rgb(255, 255, 255);\">If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server. </span>\n\n",
                  },
               ],
               value: "\nIf an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server. \n\n",
            },
         ],
         metrics: [
            {
               cvssV3_1: {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  availabilityImpact: "HIGH",
                  baseScore: 7.3,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "UNCHANGED",
                  userInteraction: "REQUIRED",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               format: "CVSS",
               scenarios: [
                  {
                     lang: "en",
                     value: "GENERAL",
                  },
               ],
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-351",
                     description: "CWE-351 Insufficient Type Distinction",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2023-06-07T20:12:46.824Z",
            orgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
            shortName: "icscert",
         },
         references: [
            {
               url: "https://www.cisa.gov/news-events/ics-advisories/icsa-23-150-01",
            },
         ],
         solutions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n\n<span style=\"background-color: rgb(255, 255, 255);\">Advantech released a new </span><a target=\"_blank\" rel=\"nofollow\" href=\"https://www.advantech.com/en/support/details/installation?id=1-MS9MJV\">version V9.1.4</a><span style=\"background-color: rgb(255, 255, 255);\">&nbsp;to address the problem by not including these files.</span>\n\n<br>",
                  },
               ],
               value: "\nAdvantech released a new  version V9.1.4 https://www.advantech.com/en/support/details/installation  to address the problem by not including these files.\n\n\n",
            },
         ],
         source: {
            discovery: "EXTERNAL",
         },
         title: "Advantech WebAccess Insufficient Type Distinction",
         workarounds: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "\n<p>Advantech recommends users locate and delete the “WADashboardSetup.msi” file to avoid this issue.</p><p>If\n users wish to remedy this problem in version 8.4.5, they can uninstall \n\"WebAccess Dashboard\" from the control panel. Delete all the files:</p><p>\\Inetpub\\wwwroot\\broadweb\\WADashboard</p><p>\\WebAccess\\Node\\WADashboardSetup.msi</p>\n\n<br>",
                  },
               ],
               value: "Advantech recommends users locate and delete the “WADashboardSetup.msi” file to avoid this issue.\n\nIf\n users wish to remedy this problem in version 8.4.5, they can uninstall \n\"WebAccess Dashboard\" from the control panel. Delete all the files:\n\n\\Inetpub\\wwwroot\\broadweb\\WADashboard\n\n\\WebAccess\\Node\\WADashboardSetup.msi\n\n\n\n\n",
            },
         ],
         x_generator: {
            engine: "Vulnogram 0.1.0-dev",
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
      assignerShortName: "icscert",
      cveId: "CVE-2023-2866",
      datePublished: "2023-06-07T20:12:46.824Z",
      dateReserved: "2023-05-24T14:09:39.667Z",
      dateUpdated: "2025-01-16T21:32:10.686Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

{
   affected_products: {
      _id: null,
      data: [
         {
            _id: null,
            model: "webaccess node",
            scope: null,
            trust: 1.4,
            vendor: "advantech",
            version: null,
         },
         {
            _id: null,
            model: "webaccess\\/scada",
            scope: "lt",
            trust: 1,
            vendor: "advantech",
            version: "8.2_20170817",
         },
         {
            _id: null,
            model: "webaccess/scada",
            scope: "lt",
            trust: 0.8,
            vendor: "advantech",
            version: "8.2_20170817",
         },
         {
            _id: null,
            model: "webaccess/scada <v8.2 20170817",
            scope: null,
            trust: 0.6,
            vendor: "advantech",
            version: null,
         },
         {
            _id: null,
            model: "webaccess/scada",
            scope: "eq",
            trust: 0.3,
            vendor: "advantech",
            version: "8.1",
         },
         {
            _id: null,
            model: "webaccess/scada",
            scope: "eq",
            trust: 0.3,
            vendor: "advantech",
            version: "8.0",
         },
         {
            _id: null,
            model: "webaccess/scada",
            scope: "eq",
            trust: 0.3,
            vendor: "advantech",
            version: "7.2",
         },
         {
            _id: null,
            model: "webaccess/scada",
            scope: "ne",
            trust: 0.3,
            vendor: "advantech",
            version: "8.3",
         },
         {
            _id: null,
            model: null,
            scope: "eq",
            trust: 0.2,
            vendor: "webaccess scada",
            version: "*",
         },
      ],
      sources: [
         {
            db: "IVD",
            id: "e2e2b550-39ab-11e9-bb92-000c29342cb1",
         },
         {
            db: "ZDI",
            id: "ZDI-18-144",
         },
         {
            db: "ZDI",
            id: "ZDI-18-143",
         },
         {
            db: "CNVD",
            id: "CNVD-2018-01710",
         },
         {
            db: "BID",
            id: "102781",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-001574",
         },
         {
            db: "NVD",
            id: "CVE-2018-5443",
         },
      ],
   },
   configurations: {
      _id: null,
      data: [
         {
            CVE_data_version: "4.0",
            nodes: [
               {
                  cpe_match: [
                     {
                        cpe22Uri: "cpe:/a:advantech:webaccess%2Fscada",
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
            ],
         },
      ],
      sources: [
         {
            db: "JVNDB",
            id: "JVNDB-2018-001574",
         },
      ],
   },
   credits: {
      _id: null,
      data: "rgod",
      sources: [
         {
            db: "ZDI",
            id: "ZDI-18-144",
         },
         {
            db: "ZDI",
            id: "ZDI-18-143",
         },
      ],
      trust: 1.4,
   },
   cve: "CVE-2018-5443",
   cvss: {
      _id: null,
      data: [
         {
            cvssV2: [
               {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  author: "nvd@nist.gov",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  exploitabilityScore: 10,
                  id: "CVE-2018-5443",
                  impactScore: 2.9,
                  integrityImpact: "NONE",
                  severity: "MEDIUM",
                  trust: 3.2,
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  author: "CNVD",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  exploitabilityScore: 10,
                  id: "CNVD-2018-01710",
                  impactScore: 2.9,
                  integrityImpact: "NONE",
                  severity: "MEDIUM",
                  trust: 0.6,
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  author: "IVD",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  exploitabilityScore: 10,
                  id: "e2e2b550-39ab-11e9-bb92-000c29342cb1",
                  impactScore: 2.9,
                  integrityImpact: "NONE",
                  severity: "MEDIUM",
                  trust: 0.2,
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.9 [IVD]",
               },
               {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  author: "VULHUB",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  exploitabilityScore: 10,
                  id: "VHN-135474",
                  impactScore: 2.9,
                  integrityImpact: "NONE",
                  severity: "MEDIUM",
                  trust: 0.1,
                  vectorString: "AV:N/AC:L/AU:N/C:P/I:N/A:N",
                  version: "2.0",
               },
            ],
            cvssV3: [
               {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  author: "nvd@nist.gov",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  exploitabilityScore: 3.9,
                  id: "CVE-2018-5443",
                  impactScore: 1.4,
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  trust: 1.8,
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
            ],
            severity: [
               {
                  author: "ZDI",
                  id: "CVE-2018-5443",
                  trust: 1.4,
                  value: "MEDIUM",
               },
               {
                  author: "nvd@nist.gov",
                  id: "CVE-2018-5443",
                  trust: 1,
                  value: "MEDIUM",
               },
               {
                  author: "NVD",
                  id: "CVE-2018-5443",
                  trust: 0.8,
                  value: "Medium",
               },
               {
                  author: "CNVD",
                  id: "CNVD-2018-01710",
                  trust: 0.6,
                  value: "MEDIUM",
               },
               {
                  author: "CNNVD",
                  id: "CNNVD-201801-959",
                  trust: 0.6,
                  value: "MEDIUM",
               },
               {
                  author: "IVD",
                  id: "e2e2b550-39ab-11e9-bb92-000c29342cb1",
                  trust: 0.2,
                  value: "MEDIUM",
               },
               {
                  author: "VULHUB",
                  id: "VHN-135474",
                  trust: 0.1,
                  value: "MEDIUM",
               },
            ],
         },
      ],
      sources: [
         {
            db: "IVD",
            id: "e2e2b550-39ab-11e9-bb92-000c29342cb1",
         },
         {
            db: "ZDI",
            id: "ZDI-18-144",
         },
         {
            db: "ZDI",
            id: "ZDI-18-143",
         },
         {
            db: "CNVD",
            id: "CNVD-2018-01710",
         },
         {
            db: "VULHUB",
            id: "VHN-135474",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-001574",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201801-959",
         },
         {
            db: "NVD",
            id: "CVE-2018-5443",
         },
      ],
   },
   description: {
      _id: null,
      data: "A SQL Injection issue was discovered in Advantech WebAccess/SCADA versions prior to V8.2_20170817. WebAccess/SCADA does not properly sanitize its inputs for SQL commands. This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Advantech WebAccess Node.  Authentication is not required to exploit this vulnerability.The specific flaw exists within the handling of the user parameter in chkLogin2.asp. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose sensitive information under the context of the database. Advantech WebAccess is a browser-based human interface HMI software package, as well as monitoring and data acquisition SCADA. Advantech WebAccess/SCADA is a browser-based SCADA software developed by Advantech. The software supports dynamic graphic display and real-time data control, and provides functions of remote control and management of automation equipment",
      sources: [
         {
            db: "NVD",
            id: "CVE-2018-5443",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-001574",
         },
         {
            db: "ZDI",
            id: "ZDI-18-144",
         },
         {
            db: "ZDI",
            id: "ZDI-18-143",
         },
         {
            db: "CNVD",
            id: "CNVD-2018-01710",
         },
         {
            db: "BID",
            id: "102781",
         },
         {
            db: "IVD",
            id: "e2e2b550-39ab-11e9-bb92-000c29342cb1",
         },
         {
            db: "VULHUB",
            id: "VHN-135474",
         },
      ],
      trust: 3.96,
   },
   external_ids: {
      _id: null,
      data: [
         {
            db: "NVD",
            id: "CVE-2018-5443",
            trust: 5,
         },
         {
            db: "ICS CERT",
            id: "ICSA-18-023-01",
            trust: 3.4,
         },
         {
            db: "BID",
            id: "102781",
            trust: 2,
         },
         {
            db: "CNNVD",
            id: "CNNVD-201801-959",
            trust: 0.9,
         },
         {
            db: "CNVD",
            id: "CNVD-2018-01710",
            trust: 0.8,
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-001574",
            trust: 0.8,
         },
         {
            db: "ZDI_CAN",
            id: "ZDI-CAN-5503",
            trust: 0.7,
         },
         {
            db: "ZDI",
            id: "ZDI-18-144",
            trust: 0.7,
         },
         {
            db: "ZDI_CAN",
            id: "ZDI-CAN-5502",
            trust: 0.7,
         },
         {
            db: "ZDI",
            id: "ZDI-18-143",
            trust: 0.7,
         },
         {
            db: "IVD",
            id: "E2E2B550-39AB-11E9-BB92-000C29342CB1",
            trust: 0.2,
         },
         {
            db: "VULHUB",
            id: "VHN-135474",
            trust: 0.1,
         },
      ],
      sources: [
         {
            db: "IVD",
            id: "e2e2b550-39ab-11e9-bb92-000c29342cb1",
         },
         {
            db: "ZDI",
            id: "ZDI-18-144",
         },
         {
            db: "ZDI",
            id: "ZDI-18-143",
         },
         {
            db: "CNVD",
            id: "CNVD-2018-01710",
         },
         {
            db: "VULHUB",
            id: "VHN-135474",
         },
         {
            db: "BID",
            id: "102781",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-001574",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201801-959",
         },
         {
            db: "NVD",
            id: "CVE-2018-5443",
         },
      ],
   },
   id: "VAR-201801-1493",
   iot: {
      _id: null,
      data: true,
      sources: [
         {
            db: "IVD",
            id: "e2e2b550-39ab-11e9-bb92-000c29342cb1",
         },
         {
            db: "CNVD",
            id: "CNVD-2018-01710",
         },
         {
            db: "VULHUB",
            id: "VHN-135474",
         },
      ],
      trust: 1.6679344999999999,
   },
   iot_taxonomy: {
      _id: null,
      data: [
         {
            category: [
               "ICS",
            ],
            sub_category: null,
            trust: 0.8,
         },
      ],
      sources: [
         {
            db: "IVD",
            id: "e2e2b550-39ab-11e9-bb92-000c29342cb1",
         },
         {
            db: "CNVD",
            id: "CNVD-2018-01710",
         },
      ],
   },
   last_update_date: "2024-11-23T22:34:24.880000Z",
   patch: {
      _id: null,
      data: [
         {
            title: "Advantech has issued an update to correct this vulnerability.",
            trust: 1.4,
            url: "https://ics-cert.us-cert.gov/advisories/ICSA-18-023-01",
         },
         {
            title: "WebAccess/SCADA",
            trust: 0.8,
            url: "http://www.advantech.com/industrial-automation/webaccess/webaccessscada",
         },
         {
            title: "Patch for Advantech WebAccess/SCADA SQL Injection Vulnerability",
            trust: 0.6,
            url: "https://www.cnvd.org.cn/patchInfo/show/114217",
         },
         {
            title: "Advantech WebAccess/SCADA SQL Repair measures for injecting vulnerabilities",
            trust: 0.6,
            url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=78083",
         },
      ],
      sources: [
         {
            db: "ZDI",
            id: "ZDI-18-144",
         },
         {
            db: "ZDI",
            id: "ZDI-18-143",
         },
         {
            db: "CNVD",
            id: "CNVD-2018-01710",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-001574",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201801-959",
         },
      ],
   },
   problemtype_data: {
      _id: null,
      data: [
         {
            problemtype: "CWE-89",
            trust: 1.9,
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-135474",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-001574",
         },
         {
            db: "NVD",
            id: "CVE-2018-5443",
         },
      ],
   },
   references: {
      _id: null,
      data: [
         {
            trust: 4.2,
            url: "https://ics-cert.us-cert.gov/advisories/icsa-18-023-01",
         },
         {
            trust: 1.7,
            url: "http://www.securityfocus.com/bid/102781",
         },
         {
            trust: 0.8,
            url: "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5443",
         },
         {
            trust: 0.8,
            url: "https://nvd.nist.gov/vuln/detail/cve-2018-5443",
         },
         {
            trust: 0.6,
            url: "https://www.proxyit.cc/advisories/icsa-18-023-01",
         },
         {
            trust: 0.3,
            url: "http://www.advantech.in/",
         },
         {
            trust: 0.3,
            url: "http://www.advantech.com/industrial-automation/webaccess/webaccessscada",
         },
      ],
      sources: [
         {
            db: "ZDI",
            id: "ZDI-18-144",
         },
         {
            db: "ZDI",
            id: "ZDI-18-143",
         },
         {
            db: "CNVD",
            id: "CNVD-2018-01710",
         },
         {
            db: "VULHUB",
            id: "VHN-135474",
         },
         {
            db: "BID",
            id: "102781",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-001574",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201801-959",
         },
         {
            db: "NVD",
            id: "CVE-2018-5443",
         },
      ],
   },
   sources: {
      _id: null,
      data: [
         {
            db: "IVD",
            id: "e2e2b550-39ab-11e9-bb92-000c29342cb1",
            ident: null,
         },
         {
            db: "ZDI",
            id: "ZDI-18-144",
            ident: null,
         },
         {
            db: "ZDI",
            id: "ZDI-18-143",
            ident: null,
         },
         {
            db: "CNVD",
            id: "CNVD-2018-01710",
            ident: null,
         },
         {
            db: "VULHUB",
            id: "VHN-135474",
            ident: null,
         },
         {
            db: "BID",
            id: "102781",
            ident: null,
         },
         {
            db: "JVNDB",
            id: "JVNDB-2018-001574",
            ident: null,
         },
         {
            db: "CNNVD",
            id: "CNNVD-201801-959",
            ident: null,
         },
         {
            db: "NVD",
            id: "CVE-2018-5443",
            ident: null,
         },
      ],
   },
   sources_release_date: {
      _id: null,
      data: [
         {
            date: "2018-01-24T00:00:00",
            db: "IVD",
            id: "e2e2b550-39ab-11e9-bb92-000c29342cb1",
            ident: null,
         },
         {
            date: "2018-02-06T00:00:00",
            db: "ZDI",
            id: "ZDI-18-144",
            ident: null,
         },
         {
            date: "2018-02-06T00:00:00",
            db: "ZDI",
            id: "ZDI-18-143",
            ident: null,
         },
         {
            date: "2018-01-24T00:00:00",
            db: "CNVD",
            id: "CNVD-2018-01710",
            ident: null,
         },
         {
            date: "2018-01-25T00:00:00",
            db: "VULHUB",
            id: "VHN-135474",
            ident: null,
         },
         {
            date: "2018-01-23T00:00:00",
            db: "BID",
            id: "102781",
            ident: null,
         },
         {
            date: "2018-02-26T00:00:00",
            db: "JVNDB",
            id: "JVNDB-2018-001574",
            ident: null,
         },
         {
            date: "2018-01-26T00:00:00",
            db: "CNNVD",
            id: "CNNVD-201801-959",
            ident: null,
         },
         {
            date: "2018-01-25T03:29:00.320000",
            db: "NVD",
            id: "CVE-2018-5443",
            ident: null,
         },
      ],
   },
   sources_update_date: {
      _id: null,
      data: [
         {
            date: "2018-02-06T00:00:00",
            db: "ZDI",
            id: "ZDI-18-144",
            ident: null,
         },
         {
            date: "2018-02-06T00:00:00",
            db: "ZDI",
            id: "ZDI-18-143",
            ident: null,
         },
         {
            date: "2018-01-24T00:00:00",
            db: "CNVD",
            id: "CNVD-2018-01710",
            ident: null,
         },
         {
            date: "2019-10-09T00:00:00",
            db: "VULHUB",
            id: "VHN-135474",
            ident: null,
         },
         {
            date: "2018-01-23T00:00:00",
            db: "BID",
            id: "102781",
            ident: null,
         },
         {
            date: "2018-02-26T00:00:00",
            db: "JVNDB",
            id: "JVNDB-2018-001574",
            ident: null,
         },
         {
            date: "2019-10-17T00:00:00",
            db: "CNNVD",
            id: "CNNVD-201801-959",
            ident: null,
         },
         {
            date: "2024-11-21T04:08:48.940000",
            db: "NVD",
            id: "CVE-2018-5443",
            ident: null,
         },
      ],
   },
   threat_type: {
      _id: null,
      data: "remote",
      sources: [
         {
            db: "CNNVD",
            id: "CNNVD-201801-959",
         },
      ],
      trust: 0.6,
   },
   title: {
      _id: null,
      data: "Advantech WebAccess/SCADA SQL Injection Vulnerability",
      sources: [
         {
            db: "CNVD",
            id: "CNVD-2018-01710",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201801-959",
         },
      ],
      trust: 1.2,
   },
   type: {
      _id: null,
      data: "SQL injection",
      sources: [
         {
            db: "IVD",
            id: "e2e2b550-39ab-11e9-bb92-000c29342cb1",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201801-959",
         },
      ],
      trust: 0.8,
   },
}

{
   "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
      affected_products: {
         "@id": "https://www.variotdbs.pl/ref/affected_products",
      },
      configurations: {
         "@id": "https://www.variotdbs.pl/ref/configurations",
      },
      credits: {
         "@id": "https://www.variotdbs.pl/ref/credits",
      },
      cvss: {
         "@id": "https://www.variotdbs.pl/ref/cvss/",
      },
      description: {
         "@id": "https://www.variotdbs.pl/ref/description/",
      },
      exploit_availability: {
         "@id": "https://www.variotdbs.pl/ref/exploit_availability/",
      },
      external_ids: {
         "@id": "https://www.variotdbs.pl/ref/external_ids/",
      },
      iot: {
         "@id": "https://www.variotdbs.pl/ref/iot/",
      },
      iot_taxonomy: {
         "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/",
      },
      patch: {
         "@id": "https://www.variotdbs.pl/ref/patch/",
      },
      problemtype_data: {
         "@id": "https://www.variotdbs.pl/ref/problemtype_data/",
      },
      references: {
         "@id": "https://www.variotdbs.pl/ref/references/",
      },
      sources: {
         "@id": "https://www.variotdbs.pl/ref/sources/",
      },
      sources_release_date: {
         "@id": "https://www.variotdbs.pl/ref/sources_release_date/",
      },
      sources_update_date: {
         "@id": "https://www.variotdbs.pl/ref/sources_update_date/",
      },
      threat_type: {
         "@id": "https://www.variotdbs.pl/ref/threat_type/",
      },
      title: {
         "@id": "https://www.variotdbs.pl/ref/title/",
      },
      type: {
         "@id": "https://www.variotdbs.pl/ref/type/",
      },
   },
   "@id": "https://www.variotdbs.pl/vuln/VAR-202102-0022",
   affected_products: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
            "@id": "https://www.variotdbs.pl/ref/sources",
         },
      },
      data: [
         {
            model: "webaccess\\/scada",
            scope: "eq",
            trust: 1,
            vendor: "advantech",
            version: "9.0.1",
         },
         {
            model: "webaccess/scada",
            scope: "eq",
            trust: 0.8,
            vendor: "アドバンテック株式会社",
            version: "9.0.1",
         },
         {
            model: "webaccess/scada",
            scope: "eq",
            trust: 0.8,
            vendor: "アドバンテック株式会社",
            version: null,
         },
         {
            model: "webaccess/scada",
            scope: "eq",
            trust: 0.6,
            vendor: "advantech",
            version: "9.0.1",
         },
      ],
      sources: [
         {
            db: "CNVD",
            id: "CNVD-2021-11305",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-016182",
         },
         {
            db: "NVD",
            id: "CVE-2020-13552",
         },
      ],
   },
   credits: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/credits#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "Discovered by Yuri Kramarz of Cisco Talos.",
      sources: [
         {
            db: "CNNVD",
            id: "CNNVD-202102-1259",
         },
      ],
      trust: 0.6,
   },
   cve: "CVE-2020-13552",
   cvss: {
      "@context": {
         cvssV2: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2",
         },
         cvssV3: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/",
         },
         severity: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/cvss/severity#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/severity",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
            "@id": "https://www.variotdbs.pl/ref/sources",
         },
      },
      data: [
         {
            cvssV2: [
               {
                  accessComplexity: "LOW",
                  accessVector: "LOCAL",
                  authentication: "NONE",
                  author: "nvd@nist.gov",
                  availabilityImpact: "COMPLETE",
                  baseScore: 7.2,
                  confidentialityImpact: "COMPLETE",
                  exploitabilityScore: 3.9,
                  id: "CVE-2020-13552",
                  impactScore: 10,
                  integrityImpact: "COMPLETE",
                  severity: "HIGH",
                  trust: 1.8,
                  vectorString: "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                  version: "2.0",
               },
               {
                  accessComplexity: "LOW",
                  accessVector: "LOCAL",
                  authentication: "NONE",
                  author: "CNVD",
                  availabilityImpact: "COMPLETE",
                  baseScore: 7.2,
                  confidentialityImpact: "COMPLETE",
                  exploitabilityScore: 3.9,
                  id: "CNVD-2021-11305",
                  impactScore: 10,
                  integrityImpact: "COMPLETE",
                  severity: "HIGH",
                  trust: 0.6,
                  vectorString: "AV:L/AC:L/Au:N/C:C/I:C/A:C",
                  version: "2.0",
               },
               {
                  accessComplexity: "LOW",
                  accessVector: "LOCAL",
                  authentication: "NONE",
                  author: "VULHUB",
                  availabilityImpact: "COMPLETE",
                  baseScore: 7.2,
                  confidentialityImpact: "COMPLETE",
                  exploitabilityScore: 3.9,
                  id: "VHN-166342",
                  impactScore: 10,
                  integrityImpact: "COMPLETE",
                  severity: "HIGH",
                  trust: 0.1,
                  vectorString: "AV:L/AC:L/AU:N/C:C/I:C/A:C",
                  version: "2.0",
               },
            ],
            cvssV3: [
               {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  author: "talos-cna@cisco.com",
                  availabilityImpact: "HIGH",
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  exploitabilityScore: 2,
                  id: "CVE-2020-13552",
                  impactScore: 6,
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  trust: 1.8,
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.0",
               },
               {
                  attackComplexity: "LOW",
                  attackVector: "LOCAL",
                  author: "nvd@nist.gov",
                  availabilityImpact: "HIGH",
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  exploitabilityScore: 2,
                  id: "CVE-2020-13552",
                  impactScore: 6,
                  integrityImpact: "HIGH",
                  privilegesRequired: "LOW",
                  scope: "CHANGED",
                  trust: 1,
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
            ],
            severity: [
               {
                  author: "nvd@nist.gov",
                  id: "CVE-2020-13552",
                  trust: 1,
                  value: "HIGH",
               },
               {
                  author: "talos-cna@cisco.com",
                  id: "CVE-2020-13552",
                  trust: 1,
                  value: "HIGH",
               },
               {
                  author: "NVD",
                  id: "CVE-2020-13552",
                  trust: 0.8,
                  value: "High",
               },
               {
                  author: "CNVD",
                  id: "CNVD-2021-11305",
                  trust: 0.6,
                  value: "HIGH",
               },
               {
                  author: "CNNVD",
                  id: "CNNVD-202102-1259",
                  trust: 0.6,
                  value: "HIGH",
               },
               {
                  author: "VULHUB",
                  id: "VHN-166342",
                  trust: 0.1,
                  value: "HIGH",
               },
            ],
         },
      ],
      sources: [
         {
            db: "CNVD",
            id: "CNVD-2021-11305",
         },
         {
            db: "VULHUB",
            id: "VHN-166342",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-016182",
         },
         {
            db: "CNNVD",
            id: "CNNVD-202102-1259",
         },
         {
            db: "NVD",
            id: "CVE-2020-13552",
         },
         {
            db: "NVD",
            id: "CVE-2020-13552",
         },
      ],
   },
   description: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/description#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege escalation via multiple service executables in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege. Advantech WebAccess/SCADA Contains a privilege management vulnerability.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state. Advantech WebAccess/SCADA is a set of SCADA software based on browser architecture of Advantech. The software supports dynamic graphic display and real-time data control, and provides functions for remote control and management of automation equipment",
      sources: [
         {
            db: "NVD",
            id: "CVE-2020-13552",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-016182",
         },
         {
            db: "CNVD",
            id: "CNVD-2021-11305",
         },
         {
            db: "VULHUB",
            id: "VHN-166342",
         },
      ],
      trust: 2.25,
   },
   external_ids: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            db: "TALOS",
            id: "TALOS-2020-1169",
            trust: 3.1,
         },
         {
            db: "NVD",
            id: "CVE-2020-13552",
            trust: 3.1,
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-016182",
            trust: 0.8,
         },
         {
            db: "CNVD",
            id: "CNVD-2021-11305",
            trust: 0.6,
         },
         {
            db: "CNNVD",
            id: "CNNVD-202102-1259",
            trust: 0.6,
         },
         {
            db: "VULHUB",
            id: "VHN-166342",
            trust: 0.1,
         },
      ],
      sources: [
         {
            db: "CNVD",
            id: "CNVD-2021-11305",
         },
         {
            db: "VULHUB",
            id: "VHN-166342",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-016182",
         },
         {
            db: "CNNVD",
            id: "CNNVD-202102-1259",
         },
         {
            db: "NVD",
            id: "CVE-2020-13552",
         },
      ],
   },
   id: "VAR-202102-0022",
   iot: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/iot#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: true,
      sources: [
         {
            db: "CNVD",
            id: "CNVD-2021-11305",
         },
         {
            db: "VULHUB",
            id: "VHN-166342",
         },
      ],
      trust: 1.3586421999999998,
   },
   iot_taxonomy: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            category: [
               "ICS",
            ],
            sub_category: null,
            trust: 0.6,
         },
      ],
      sources: [
         {
            db: "CNVD",
            id: "CNVD-2021-11305",
         },
      ],
   },
   last_update_date: "2024-11-23T22:40:46.773000Z",
   patch: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/patch#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            title: "WebAccess/SCADA",
            trust: 0.8,
            url: "https://www.advantech.com/industrial-automation/webaccess/webaccessscada",
         },
         {
            title: "Advantech WebAccess/SCADA Security vulnerabilities",
            trust: 0.6,
            url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=142126",
         },
      ],
      sources: [
         {
            db: "JVNDB",
            id: "JVNDB-2020-016182",
         },
         {
            db: "CNNVD",
            id: "CNNVD-202102-1259",
         },
      ],
   },
   problemtype_data: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            problemtype: "CWE-276",
            trust: 1.1,
         },
         {
            problemtype: "Improper authority management (CWE-269) [NVD Evaluation ]",
            trust: 0.8,
         },
         {
            problemtype: "CWE-269",
            trust: 0.1,
         },
      ],
      sources: [
         {
            db: "VULHUB",
            id: "VHN-166342",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-016182",
         },
         {
            db: "NVD",
            id: "CVE-2020-13552",
         },
      ],
   },
   references: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/references#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            trust: 3.1,
            url: "https://talosintelligence.com/vulnerability_reports/talos-2020-1169",
         },
         {
            trust: 1.4,
            url: "https://nvd.nist.gov/vuln/detail/cve-2020-13552",
         },
      ],
      sources: [
         {
            db: "CNVD",
            id: "CNVD-2021-11305",
         },
         {
            db: "VULHUB",
            id: "VHN-166342",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-016182",
         },
         {
            db: "CNNVD",
            id: "CNNVD-202102-1259",
         },
         {
            db: "NVD",
            id: "CVE-2020-13552",
         },
      ],
   },
   sources: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            db: "CNVD",
            id: "CNVD-2021-11305",
         },
         {
            db: "VULHUB",
            id: "VHN-166342",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2020-016182",
         },
         {
            db: "CNNVD",
            id: "CNNVD-202102-1259",
         },
         {
            db: "NVD",
            id: "CVE-2020-13552",
         },
      ],
   },
   sources_release_date: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            date: "2021-02-22T00:00:00",
            db: "CNVD",
            id: "CNVD-2021-11305",
         },
         {
            date: "2021-02-17T00:00:00",
            db: "VULHUB",
            id: "VHN-166342",
         },
         {
            date: "2021-11-12T00:00:00",
            db: "JVNDB",
            id: "JVNDB-2020-016182",
         },
         {
            date: "2021-02-16T00:00:00",
            db: "CNNVD",
            id: "CNNVD-202102-1259",
         },
         {
            date: "2021-02-17T19:15:12.450000",
            db: "NVD",
            id: "CVE-2020-13552",
         },
      ],
   },
   sources_update_date: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            date: "2021-02-22T00:00:00",
            db: "CNVD",
            id: "CNVD-2021-11305",
         },
         {
            date: "2022-06-29T00:00:00",
            db: "VULHUB",
            id: "VHN-166342",
         },
         {
            date: "2021-11-12T01:22:00",
            db: "JVNDB",
            id: "JVNDB-2020-016182",
         },
         {
            date: "2022-04-20T00:00:00",
            db: "CNNVD",
            id: "CNNVD-202102-1259",
         },
         {
            date: "2024-11-21T05:01:28.920000",
            db: "NVD",
            id: "CVE-2020-13552",
         },
      ],
   },
   threat_type: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "local",
      sources: [
         {
            db: "CNNVD",
            id: "CNNVD-202102-1259",
         },
      ],
      trust: 0.6,
   },
   title: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/title#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "Advantech WebAccess/SCADA  Vulnerability in privilege management",
      sources: [
         {
            db: "JVNDB",
            id: "JVNDB-2020-016182",
         },
      ],
      trust: 0.8,
   },
   type: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/type#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "other",
      sources: [
         {
            db: "CNNVD",
            id: "CNNVD-202102-1259",
         },
      ],
      trust: 0.6,
   },
}