CVE-2023-32540

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the operating system (including system files), inject code into an XLS file, and modify the file extension, which could lead to arbitrary code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Jun 6, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-325417.8A use-after-free vulnerability exists in the footerr functionality of Hancom Office 2020 HWord 11.0.0.7520. A specially crafted .doc file ca CVE-2023-325427.8Out-of-bounds read vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted V8 file may lead to infor CVE-2023-325437.8Incorrect default permissions in the Intel(R) ITS sofware before version 3.1 may allow authenticated user to potentially enable escalation o CVE-2023-325445.5Improper access control in some Intel HotKey Services for Windows 10 for Intel NUC P14E Laptop Element software installers before version 1.CVE-2023-325457.8The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to an out-of-CVE-2023-325464.4Code injection vulnerability exists in Chatwork Desktop Application (Mac) 2.6.43 and earlier. If this vulnerability is exploited, a non-admi CVE-2023-325477.8Incorrect default permissions in the MAVinci Desktop Software for Intel(R) Falcon 8+ before version 6.2 may allow authenticated user to pote CVE-2023-325488.1OS command injection vulnerability exists in WPS Office version 10.8.0.6186. If a remote attacker who can conduct a man-in-the-middle attack CVE-2023-325497.5Landscape cryptographic keys were insecurely generated with a weak pseudo-random generator.CVE-2023-32556.5A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loo CVE-2023-325508.2Landscape's server-status page exposed sensitive system information. This data leak included GET requests which contain information to attac CVE-2023-325516.1Landscape allowed URLs which caused open redirection.