Lucene search

TalosCVE-2020-13554

HistoryMar 03, 2021 - 5:15 p.m.

CVE-2020-13554

2021-03-0317:15:11

CWE-276

talos

web.nvd.nist.gov

cve-2020-13554

local privilege elevation

advantech webaccess

scada

vulnerability

nt system privilege

webvrpcs

run key privilege escalation

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

20.4%

JSON

An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In webvrpcs Run Key Privilege Escalation in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.

Affected configurations

Nvd

Node

advantechwebaccess\/scadaMatch9.0.1

VendorProductVersionCPE
advantechwebaccess\/scada9.0.1cpe:2.3:a:advantech:webaccess\/scada:9.0.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
advantech	webaccess\/scada	9.0.1	cpe:2.3:a:advantech:webaccess\/scada:9.0.1:::::::*

CNA Affected

[
  {
    "product": "Advantech",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Advantech WebAccess/SCADA 9.0.1"
      }
    ]
  }
]

References

talosintelligence.com/vulnerability_reports/TALOS-2020-1169

Social References

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

Confidence

High

EPSS

0.001

Percentile

20.4%

JSON

Related for CVE-2020-13554