If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server.
The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Webaccess | Advantech | 8.4.5 (including) | 8.4.5 (including) |