CVE-2018-14820

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbitrary file deletion when processing.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-73 CWE-20

Affected software

Vendor	Product	Versions
Advantech	Advantech WebAccess	WebAccess Versions 8.3.1 and prior

References

http://www.securityfocus.com/bid/105728Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041939Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-296-01%2C
http://www.securityfocus.com/bid/105728Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1041939Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-296-01%2C

Timeline

Published: Oct 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-148217.5Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote, unauthenticated threat actor to intent CVE-2018-148229.8Entes EMG12 versions 2.57 and prior an information exposure through query strings vulnerability in the web interface has been identified, wh CVE-2018-148239.8Fuji Electric V-Server 4.0.3.0 and prior, A stack-based buffer overflow vulnerability has been identified, which may allow remote code execu CVE-2018-148246.5Delta Electronics Delta Industrial Automation PMSoft v2.11 or prior has an out-of-bounds read vulnerability that can be executed when proces CVE-2018-148255.8On Honeywell Mobile Computers (CT60 running Android OS 7.1, CN80 running Android OS 7.1, CT40 running Android OS 7.1, CK75 running Android O CVE-2018-148269.8Entes EMG12 versions 2.57 and prior The application uses a web interface where it is possible for an attacker to bypass authentication with CVE-2018-148277.5Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. A remote, unauthenticated threat actor may intentionally send specially craft CVE-2018-148287.8Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files CVE-2018-148299.8Rockwell Automation RSLinx Classic Versions 4.00.01 and prior. This vulnerability may allow a remote threat actor to intentionally send a ma CVE-2018-14836.1IBM WebSphere Portal 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i CVE-2018-148314.9An arbitrary file read vulnerability in DamiCMS v6.0.0 allows remote authenticated administrators to read any files in the server via a craf CVE-2018-148335.9Intuit Lacerte 2017 has Incorrect Access Control.