Security News Advantech WebAccess RCE flaw still exploitable, exploit code available

[LASER_oneXM]

Content source

https://www.helpnetsecurity.com/2018/09/11/cve-2017-16720/

A vulnerability in Advantech WebAccess, a web browser-based software package for human-machine interfaces (HMI) and supervisory control and data acquisition (SCADA) systems, allows attackers to remotely executed commands with administrator privileges on vulnerable systems.

The flaw (CVE-2017-16720) was supposed to be and was purportedly patched, but Tenable researchers claim otherwise. And what’s even worse, an exploit for it that works out-of-the-box has been available online for nearly six months.