CVE-2018-14816

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Advantech WebAccess 8.3.1 and earlier has several stack-based buffer overflow vulnerabilities that have been identified, which may allow an attacker to execute arbitrary code.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Advantech	Advantech WebAccess	WebAccess Versions 8.3.1 and prior

References

http://www.securityfocus.com/bid/105728Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041939Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-296-01%2C
http://www.securityfocus.com/bid/105728Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041939Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-296-01%2C

Timeline

Published: Oct 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-148179.8Fuji Electric V-Server 4.0.3.0 and prior, An integer underflow vulnerability has been identified, which may allow remote code execution.CVE-2018-148189.8WECON Technology Co., Ltd. PI Studio HMI versions 4.1.9 and prior and PI Studio versions 4.2.34 and prior have a stack-based buffer overflow CVE-2018-148199.8Fuji Electric V-Server 4.0.3.0 and prior, An out-of-bounds read vulnerability has been identified, which may allow remote code execution.CVE-2018-148207.5Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which CVE-2018-148217.5Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote, unauthenticated threat actor to intent CVE-2018-148229.8Entes EMG12 versions 2.57 and prior an information exposure through query strings vulnerability in the web interface has been identified, wh CVE-2018-148239.8Fuji Electric V-Server 4.0.3.0 and prior, A stack-based buffer overflow vulnerability has been identified, which may allow remote code execu CVE-2018-148246.5Delta Electronics Delta Industrial Automation PMSoft v2.11 or prior has an out-of-bounds read vulnerability that can be executed when proces CVE-2018-148255.8On Honeywell Mobile Computers (CT60 running Android OS 7.1, CN80 running Android OS 7.1, CT40 running Android OS 7.1, CK75 running Android O CVE-2018-148269.8Entes EMG12 versions 2.57 and prior The application uses a web interface where it is possible for an attacker to bypass authentication with CVE-2018-148277.5Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. A remote, unauthenticated threat actor may intentionally send specially craft CVE-2018-148287.8Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files