Advantech Webaccess/nms — known CVE vulnerabilities

Every CVE whose affected-product data names Advantech Webaccess/nms, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (20)

• CVE-2018-10589 — CVSS 9.8 (critical): In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and…
• CVE-2018-7497 — CVSS 9.8 (critical): In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and…
• CVE-2018-7499 — CVSS 9.8 (critical): In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and…
• CVE-2018-7505 — CVSS 9.8 (critical): In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and…
• CVE-2018-8845 — CVSS 9.8 (critical): In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and…
• CVE-2020-10621 — CVSS 9.8 (critical): Multiple issues exist that allow files to be uploaded and executed on the WebAccess/NMS (versions prior to 3.0.2).
• CVE-2020-10625 — CVSS 9.8 (critical): WebAccess/NMS (versions prior to 3.0.2) allows an unauthenticated remote user to create a new admin account.
• CVE-2020-10631 — CVSS 9.8 (critical): An attacker could use a specially crafted URL to delete or read files outside the WebAccess/NMS's (versions prior to 3.0.2) control.
• CVE-2020-10619 — CVSS 9.1 (critical): An attacker could use a specially crafted URL to delete files outside the WebAccess/NMS's (versions prior to 3.0.2) control.
• CVE-2020-10603 — CVSS 8.8 (high): WebAccess/NMS (versions prior to 3.0.2) does not properly sanitize user input and may allow an attacker to inject system commands remotely.
• CVE-2018-8841 — CVSS 7.8 (high): In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and…
• CVE-2018-10590 — CVSS 7.5 (high): In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and…
• CVE-2018-7501 — CVSS 7.5 (high): In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and…
• CVE-2018-7495 — CVSS 7.5 (high): In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and…
• CVE-2020-10617 — CVSS 7.5 (high): There are multiple ways an unauthenticated attacker could perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to gain access…
• CVE-2018-7503 — CVSS 7.5 (high): In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and…
• CVE-2020-10629 — CVSS 7.5 (high): WebAccess/NMS (versions prior to 3.0.2) does not sanitize XML input. Specially crafted XML input could allow an attacker to read sensitive…
• CVE-2020-10623 — CVSS 6.5 (medium): Multiple vulnerabilities could allow an attacker with low privileges to perform SQL injection on WebAccess/NMS (versions prior to 3.0.2) to…
• CVE-2018-10591 — CVSS 6.1 (medium): In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and…
• CVE-2021-32951 — CVSS 5.3 (medium): WebAccess/NMS (Versions prior to v3.0.3_Build6299) has an improper authentication vulnerability, which may allow unauthorized users to view…