title: Advantech WebAccess Insufficient Type Distinction
description:
If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server.
problem types: CWE-351 Insufficient Type Distinction
affected:
{
defaultStatus: unaffected
product: WebAccess/SCADA
vendor: Advantech
versions:
status: affected, version: 8.4.5
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
]
format: CVSS
scenarios: GENERAL
solutions:
Advantech released a new  version V9.1.4 https://www.advantech.com/en/support/details/installation  to address the problem by not including these files.
workarounds: Advantech recommends users locate and delete the “WADashboardSetup.msi” file to avoid this issue.
If
users wish to remedy this problem in version 8.4.5, they can uninstall
"WebAccess Dashboard" from the control panel. Delete all the files:
\Inetpub\wwwroot\broadweb\WADashboard
\WebAccess\Node\WADashboardSetup.msi