[0day-rubbish] Advantech WebAccess Node 9.2.3 unauthenticated CrystalRpt.aspx file upload and path traversal to code execution in w3wp.exe (9.8)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-10-06 17:44 UTC
Importiert: 2026-10-06 18:50 UTC
Quelle-ID: full_disc
uid_hash: 14a04a7708bf740ff39d10cfc9fac3fef5854d9fa047559b5b44105700e5bc80

Full Disclosure

Posted by disclosure via Fulldisclosure on Oct 06 0day Rubbish Research Team is publicly disclosing a vulnerability in Advantech

WebAccess Node 9.2.3, the closed-source industrial SCADA/HMI web server from

Advantech (Taiwan).

Type: unrestricted file upload (CWE-434) compounded by path traversal (CWE-22), on

a page that performs no authorization decision at all (CWE-306). CWE-73 and CWE-862

also map; CWE-250/CWE-269 apply conditionally where the pool runs at high

privilege. In the WaCrpt ASP.NET...

No data

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss