CVE-2017-12710

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A SQL Injection issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. By submitting a specially crafted parameter, it is possible to inject arbitrary SQL statements that could allow an attacker to obtain sensitive information.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
n/a	Advantech WebAccess	Advantech WebAccess

References

http://www.securityfocus.com/bid/100526Third Party Advisory, VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-17-712/
https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02Third Party Advisory, US Government Resource
https://www.tenable.com/security/research/tra-2017-29
http://www.securityfocus.com/bid/100526Third Party Advisory, VDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-17-712/
https://ics-cert.us-cert.gov/advisories/ICSA-17-241-02Third Party Advisory, US Government Resource
https://www.tenable.com/security/research/tra-2017-29

Timeline

Published: Aug 30, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-127117.8An Incorrect Privilege Assignment issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A built-in user account has b CVE-2017-127128.8The authentication algorithm in Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017, which involves an authentication key and CVE-2017-127137.8An Incorrect Permission Assignment for Critical Resource issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multip CVE-2017-127146.5Abbott Laboratories pacemakers manufactured prior to Aug 28, 2017 do not restrict or limit the number of correctly formatted "RF wake-up" co CVE-2017-127166.5Abbott Laboratories Accent and Anthem pacemakers manufactured prior to Aug 28, 2017 transmit unencrypted patient information via RF communic CVE-2017-127177.8An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A maliciously crafted dll f CVE-2017-127188.1A Classic Buffer Overflow issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A CVE-2017-127197.5An Untrusted Pointer Dereference issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A remote attacker is able to e CVE-2017-12725.3IBM Security Guardium 10.0 and 10.5 stores sensitive information in URL parameters. This may lead to information disclosure if unauthorized CVE-2017-127208.1An Improper Access Control issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. CVE-2017-127215.9An Improper Certificate Validation issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, a CVE-2017-127225.3An Out-of-bounds Read issue was discovered in Smiths Medical Medfusion 4000 Wireless Syringe Infusion Pump, Version 1.1, 1.5, and 1.6. A thi