Vulnerability Spotlight: Two vulnerabilities in Advantech Web Access/SCADA
Summary: Cisco Talos discovered two vulnerabilities in Advantech WebAccess/SCADA 9.0.1, an HTML-5 package used for data visualization and supervisory control of IoT and operational technology devices. One is a local file inclusion flaw (TALOS-2020-1168/CVE-2020-13550) triggered by an authenticated HTTP request that can disclose information, and the other is a set of local privilege elevation flaws in file system permissions (TALOS-2020-1169/CVE-2020-13551 through CVE-2020-13555) that can let an attacker replace binaries or loaded modules to execute code with NT SYSTEM privilege.
What you should know: Talos disclosed these flaws despite Advantech not confirming a fix, so the software running supervisory control over OT and IoT devices may remain exposed with no vendor patch in hand. The privilege escalation path ends at NT SYSTEM, the highest local privilege on a Windows host.
Read the original at Cisco Talos ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2020-13550CVE-2020-13551CVE-2020-13555
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026