Advantech WebAccess HMI Designer up to 2.1.9.31 Project File double free

Summaryinfo

A vulnerability was found in Advantech WebAccess HMI Designer up to 2.1.9.31. It has been declared as problematic. This affects an unknown function. The manipulation as part of Project File results in double free. This vulnerability is cataloged as CVE-2020-16217. The attack must be initiated from a local position. There is no exploit available.

Detailsinfo

A vulnerability classified as problematic has been found in Advantech WebAccess HMI Designer up to 2.1.9.31 (SCADA Software). Affected is some unknown processing. The manipulation as part of a Project File leads to a double free vulnerability. CWE is classifying the issue as CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations. This is going to have an impact on availability. CVE summarizes:

Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prior. A double free vulnerability caused by processing specially crafted project files may allow remote code execution, disclosure/modification of information, or cause the application to crash.

The weakness was shared 08/06/2020 (Website). The advisory is available at us-cert.cisa.gov. This vulnerability is traded as CVE-2020-16217 since 07/31/2020. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. The technical details are unknown and an exploit is not available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-159350, VDB-159351, VDB-159352 and VDB-159353 are related to this item. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• SCADA Software

Vendor

• Advantech

Name

• WebAccess HMI Designer

Version

• 2.1.9.0
• 2.1.9.1
• 2.1.9.2
• 2.1.9.3
• 2.1.9.4
• 2.1.9.5
• 2.1.9.6
• 2.1.9.7
• 2.1.9.8
• 2.1.9.9
• 2.1.9.10
• 2.1.9.11
• 2.1.9.12
• 2.1.9.13
• 2.1.9.14
• 2.1.9.15
• 2.1.9.16
• 2.1.9.17
• 2.1.9.18
• 2.1.9.19
• 2.1.9.20
• 2.1.9.21
• 2.1.9.22
• 2.1.9.23
• 2.1.9.24
• 2.1.9.25
• 2.1.9.26
• 2.1.9.27
• 2.1.9.28
• 2.1.9.29
• 2.1.9.30
• 2.1.9.31

License

• commercial

Website

• Vendor: https://www.advantech.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion