Advantech WebAccess SCADA
CVE-2021-38431

4.3MEDIUM

Key Information:

Vendor

Advantech
Status
Webaccess Scada
Vendor
CVE Published:
15 October 2021

What is CVE-2021-38431?

An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users.

Affected Version(s)

WebAccess SCADA All <= 9.0.3

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-285-01
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Peter Cheng from ELEX FEIGONG RESEARCH INSTITUTE of Elex CyberSecurity, Inc., reported this vulnerability to CISA.
.