CVE-2024-2453
Advantech WebAccess/SCADA SQL Injection
- State
- Published
- Severity
- 6.4 Medium
- Published
- Mar 21, 2024
- Updated
- Aug 1, 2024
- Reserved
- Mar 14, 2024
Description
There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.4 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N | icscert |
Weaknesses
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected Products
| Product | Versions |
|---|---|
WebAccess/SCADAAdvantech |
|
References
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-081-01government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.