Lucene search
HistoryJun 07, 2023 - 9:15 p.m.
CVE-2023-2866
attacker
authenticated user
malicious zip file
web shell
scada server
control
CVSS3
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
7.2
Confidence
High
EPSS
0.001
Percentile
23.1%
If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server.
Affected configurations
Node
advantechwebaccessMatch8.4.5
Related
prion
prion
Code injection
2023-06-07 21:15:00
cvelist
cvelist
CVE-2023-2866 Advantech WebAccess Insufficient Type Distinction
2023-06-07 20:12:46
ics
ics
Advantech WebAccess/SCADA
2023-05-30 12:00:00
cve
cve
CVE-2023-2866
2023-06-07 21:15:13
CVSS3
7.8
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
7.2
Confidence
High
EPSS
0.001
Percentile
23.1%
Related for NVD:CVE-2023-2866