CVE-2019-6550

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-121 CWE-787

Affected software

Vendor	Product	Versions
Advantech	WebAccess/SCADA	Versions 8.3.5 and prior.

References

https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-19-585/Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-19-092-01Third Party Advisory, US Government Resource
https://www.zerodayinitiative.com/advisories/ZDI-19-585/Third Party Advisory, VDB Entry

Timeline

Published: Apr 5, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-65517.5Pangea Communications Internet FAX ATA all Versions 3.1.8 and prior allow an attacker to bypass user authentication using a specially crafte CVE-2019-65529.8Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of us CVE-2019-65539.8A vulnerability was found in Rockwell Automation RSLinx Classic versions 4.10.00 and prior. An input validation issue in a .dll file of RSLi CVE-2019-65547.5Advantech WebAccess/SCADA, Versions 8.3.5 and prior. An improper access control vulnerability may allow an attacker to cause a denial-of-ser CVE-2019-65557.8Cscape, 9.80 SP4 and prior. An improper input validation vulnerability may be exploited by processing specially crafted POC files. This may CVE-2019-65566.6When processing project files, the application (Omron CX-Programmer v9.70 and prior and Common Components January 2019 and prior) fails to c CVE-2019-65579.8Several buffer overflow vulnerabilities have been identified in Moxa IKS and EDS, which may allow remote code execution.CVE-2019-65587.5In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a CVE-2019-65596.5Moxa IKS and EDS allow remote authenticated users to cause a denial of service via a specially crafted packet, which may cause the switch to CVE-2019-65609.1In Auto-Maskin RP210E Versions 3.7 and prior, DCU210E Versions 3.7 and prior and Marine Observer Pro (Android App), the software contains a CVE-2019-65618.8Cross-site request forgery has been identified in Moxa IKS and EDS, which may allow for the execution of unauthorized actions on the device.CVE-2019-65625.4In Philips Tasy EMR, Tasy EMR Versions 3.02.1744 and prior, the software incorrectly neutralizes user-controllable input before it is placed