CVE-2017-12710

A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to obtain sensitive information.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
icscertCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 64%
VendorProductVersion
advantechwebaccess
𝑥
≤ 8.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://www.securityfocus.com/bid/100526
http://www.zerodayinitiative.com/advisories/ZDI-17-712/
https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02
https://www.tenable.com/security/research/tra-2017-29
http://www.securityfocus.com/bid/100526
http://www.zerodayinitiative.com/advisories/ZDI-17-712/
https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02
https://www.tenable.com/security/research/tra-2017-29