https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2023-4215.htmlhttps://patchthecve.com/cve/CVE-2023-4215.htmlWed, 17 Jun 2026 06:37:20 +0000MEDIUM 6.5: Advantech WebAccess version 9.1.3 contains an exposure of sensitive information to an unauthorized actor vulnerability that could leak user credentials.https://patchthecve.com/cve/CVE-2023-2866.htmlhttps://patchthecve.com/cve/CVE-2023-2866.htmlWed, 17 Jun 2026 05:53:39 +0000HIGH 7.3: If an attacker can trick an authenticated user into loading a maliciously crafted .zip file onto Advantech WebAccess version 8.4.5, a web shell could be used to give the attacker full control of the SCADA server. https://patchthecve.com/cve/CVE-2021-38389.htmlhttps://patchthecve.com/cve/CVE-2021-38389.htmlWed, 17 Jun 2026 04:02:00 +0000CRITICAL 9.8: Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code.https://patchthecve.com/cve/CVE-2021-33023.htmlhttps://patchthecve.com/cve/CVE-2021-33023.htmlWed, 17 Jun 2026 03:54:01 +0000CRITICAL 9.8: Advantech WebAccess versions 9.02 and prior are vulnerable to a heap-based buffer overflow, which may allow an attacker to remotely execute code.https://patchthecve.com/cve/CVE-2021-38408.htmlhttps://patchthecve.com/cve/CVE-2021-38408.htmlWed, 17 Jun 2026 04:02:02 +0000CRITICAL 9.8: A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the length of user-supplied data may allow remote code execution.https://patchthecve.com/cve/CVE-2021-34540.htmlhttps://patchthecve.com/cve/CVE-2021-34540.htmlWed, 17 Jun 2026 03:56:05 +0000MEDIUM 6.1: Advantech WebAccess 8.4.2 and 8.4.4 allows XSS via the username column of the bwRoot.asp page of WADashboard.https://patchthecve.com/cve/CVE-2020-16202.htmlhttps://patchthecve.com/cve/CVE-2020-16202.htmlWed, 17 Jun 2026 02:57:50 +0000HIGH 7.8: WebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific services, which may allow code execution with system privileges.https://patchthecve.com/cve/CVE-2020-12019.htmlhttps://patchthecve.com/cve/CVE-2020-12019.htmlWed, 17 Jun 2026 02:51:15 +0000CRITICAL 9.8: WebAccess Node Version 8.4.4 and prior is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code.https://patchthecve.com/cve/CVE-2020-12026.htmlhttps://patchthecve.com/cve/CVE-2020-12026.htmlWed, 17 Jun 2026 02:51:16 +0000HIGH 8.8: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s control.https://patchthecve.com/cve/CVE-2020-12022.htmlhttps://patchthecve.com/cve/CVE-2020-12022.htmlWed, 17 Jun 2026 02:51:16 +0000CRITICAL 9.8: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An improper validation vulnerability exists that could allow an attacker to inject specially crafted input into memory where it can be executed.https://patchthecve.com/cve/CVE-2020-12018.htmlhttps://patchthecve.com/cve/CVE-2020-12018.htmlWed, 17 Jun 2026 02:51:15 +0000HIGH 7.5: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. An out-of-bounds vulnerability exists that may allow access to unauthorized data.https://patchthecve.com/cve/CVE-2020-12014.htmlhttps://patchthecve.com/cve/CVE-2020-12014.htmlWed, 17 Jun 2026 02:51:15 +0000HIGH 7.5: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Input is not properly sanitized and may allow an attacker to inject SQL commands.https://patchthecve.com/cve/CVE-2020-12010.htmlhttps://patchthecve.com/cve/CVE-2020-12010.htmlWed, 17 Jun 2026 02:51:14 +0000HIGH 7.1: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow an authenticated user to use a specially crafted file to delete files outside the application’s control.https://patchthecve.com/cve/CVE-2020-12006.htmlhttps://patchthecve.com/cve/CVE-2020-12006.htmlWed, 17 Jun 2026 02:51:14 +0000CRITICAL 9.8: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple relative path traversal vulnerabilities exist that may allow a low privilege user to overwrite files outside the application’s control.https://patchthecve.com/cve/CVE-2020-12002.htmlhttps://patchthecve.com/cve/CVE-2020-12002.htmlWed, 17 Jun 2026 02:51:14 +0000CRITICAL 9.8: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple stack-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution.https://patchthecve.com/cve/CVE-2020-10638.htmlhttps://patchthecve.com/cve/CVE-2020-10638.htmlWed, 17 Jun 2026 02:48:08 +0000CRITICAL 9.8: Advantech WebAccess Node, Version 8.4.4 and prior, Version 9.0.0. Multiple heap-based buffer overflow vulnerabilities exist caused by a lack of proper validation of the length of user-supplied data, which may allow remote code execution.https://patchthecve.com/cve/CVE-2019-3942.htmlhttps://patchthecve.com/cve/CVE-2019-3942.htmlWed, 17 Jun 2026 02:35:55 +0000HIGH 7.5: Advantech WebAccess 8.3.4 does not properly restrict an RPC call that allows unauthenticated, remote users to read files. An attacker can use this vulnerability to recover the administrator password.https://patchthecve.com/cve/CVE-2020-10607.htmlhttps://patchthecve.com/cve/CVE-2020-10607.htmlWed, 17 Jun 2026 02:48:05 +0000HIGH 8.8: In Advantech WebAccess, Versions 8.4.2 and prior. A stack-based buffer overflow vulnerability caused by a lack of proper validation of the length of user-supplied data may allow remote code execution.https://patchthecve.com/cve/CVE-2019-3951.htmlhttps://patchthecve.com/cve/CVE-2019-3951.htmlWed, 17 Jun 2026 02:35:56 +0000CRITICAL 9.8: Advantech WebAccess before 8.4.3 allows unauthenticated remote attackers to execute arbitrary code or cause a denial of service (memory corruption) due to a stack-based buffer overflow when handling IOCTL 70533 RPC messages.https://patchthecve.com/cve/CVE-2019-13558.htmlhttps://patchthecve.com/cve/CVE-2019-13558.htmlWed, 17 Jun 2026 02:16:58 +0000CRITICAL 9.8: In WebAccess versions 8.4.1 and prior, an exploit executed over the network may cause improper control of generation of code, which may allow remote code execution, data exfiltration, or cause a system crash.https://patchthecve.com/cve/CVE-2019-13556.htmlhttps://patchthecve.com/cve/CVE-2019-13556.htmlWed, 17 Jun 2026 02:16:58 +0000HIGH 8.8: In WebAccess versions 8.4.1 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution.https://patchthecve.com/cve/CVE-2019-13552.htmlhttps://patchthecve.com/cve/CVE-2019-13552.htmlWed, 17 Jun 2026 02:16:57 +0000HIGH 8.8: In WebAccess versions 8.4.1 and prior, multiple command injection vulnerabilities are caused by a lack of proper validation of user-supplied data and may allow arbitrary file deletion and remote code execution.https://patchthecve.com/cve/CVE-2019-13550.htmlhttps://patchthecve.com/cve/CVE-2019-13550.htmlWed, 17 Jun 2026 02:16:57 +0000CRITICAL 9.8: In WebAccess, versions 8.4.1 and prior, an improper authorization vulnerability may allow an attacker to disclose sensitive information, cause improper control of generation of code, which may allow remote code execution or cause a system crash.https://patchthecve.com/cve/CVE-2019-3975.htmlhttps://patchthecve.com/cve/CVE-2019-3975.htmlWed, 17 Jun 2026 02:35:58 +0000CRITICAL 9.8: Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message.https://patchthecve.com/cve/CVE-2019-10993.htmlhttps://patchthecve.com/cve/CVE-2019-10993.htmlWed, 17 Jun 2026 02:12:04 +0000CRITICAL 9.8: In WebAccess/SCADA Versions 8.3.5 and prior, multiple untrusted pointer dereference vulnerabilities may allow a remote attacker to execute arbitrary code.https://patchthecve.com/cve/CVE-2019-10991.htmlhttps://patchthecve.com/cve/CVE-2019-10991.htmlWed, 17 Jun 2026 02:12:04 +0000CRITICAL 9.8: In WebAccess/SCADA, Versions 8.3.5 and prior, multiple stack-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution.https://patchthecve.com/cve/CVE-2019-10989.htmlhttps://patchthecve.com/cve/CVE-2019-10989.htmlWed, 17 Jun 2026 02:12:04 +0000CRITICAL 9.8: In WebAccess/SCADA Versions 8.3.5 and prior, multiple heap-based buffer overflow vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution. Note: A different vulnerability than CVE-2019-10991.https://patchthecve.com/cve/CVE-2019-10987.htmlhttps://patchthecve.com/cve/CVE-2019-10987.htmlWed, 17 Jun 2026 02:12:03 +0000HIGH 8.8: In WebAccess/SCADA Versions 8.3.5 and prior, multiple out-of-bounds write vulnerabilities are caused by a lack of proper validation of the length of user-supplied data. Exploitation of these vulnerabilities may allow remote code execution.https://patchthecve.com/cve/CVE-2019-10985.htmlhttps://patchthecve.com/cve/CVE-2019-10985.htmlWed, 17 Jun 2026 02:12:03 +0000CRITICAL 9.1: In WebAccess/SCADA, Versions 8.3.5 and prior, a path traversal vulnerability is caused by a lack of proper validation of a user-supplied path prior to use in file operations. An attacker can leverage this vulnerability to delete files while posing as an administrator.https://patchthecve.com/cve/CVE-2019-10983.htmlhttps://patchthecve.com/cve/CVE-2019-10983.htmlWed, 17 Jun 2026 02:12:03 +0000HIGH 7.5: In WebAccess/SCADA Versions 8.3.5 and prior, an out-of-bounds read vulnerability is caused by a lack of proper validation of user-supplied data. Exploitation of this vulnerability may allow disclosure of information.https://patchthecve.com/cve/CVE-2019-3954.htmlhttps://patchthecve.com/cve/CVE-2019-3954.htmlWed, 17 Jun 2026 02:35:56 +0000CRITICAL 9.8: Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 81024 RPC call.https://patchthecve.com/cve/CVE-2019-3953.htmlhttps://patchthecve.com/cve/CVE-2019-3953.htmlWed, 17 Jun 2026 02:35:56 +0000CRITICAL 9.8: Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.0 allows a remote, unauthenticated attacker to execute arbitrary code by sending a crafted IOCTL 10012 RPC call.https://patchthecve.com/cve/CVE-2019-7219.htmlhttps://patchthecve.com/cve/CVE-2019-7219.htmlWed, 17 Jun 2026 02:40:16 +0000MEDIUM 6.1: Unauthenticated reflected cross-site scripting (XSS) exists in Zarafa Webapp 2.0.1.47791 and earlier. NOTE: this is a discontinued product. The issue was fixed in later Zarafa Webapp versions; however, some former Zarafa Webapp customers use the related Kopano product instead.https://patchthecve.com/cve/CVE-2019-3941.htmlhttps://patchthecve.com/cve/CVE-2019-3941.htmlWed, 17 Jun 2026 02:35:55 +0000HIGH 7.5: Advantech WebAccess 8.3.4 allows unauthenticated, remote attackers to delete arbitrary files via IOCTL 10005 RPC.https://patchthecve.com/cve/CVE-2019-3940.htmlhttps://patchthecve.com/cve/CVE-2019-3940.htmlWed, 17 Jun 2026 02:35:55 +0000CRITICAL 9.8: Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call. An unauthenticated, remote attacker can use this vulnerability to execute arbitrary code.https://patchthecve.com/cve/CVE-2019-6554.htmlhttps://patchthecve.com/cve/CVE-2019-6554.htmlWed, 17 Jun 2026 02:39:14 +0000HIGH 7.5: Advantech WebAccess/SCADA, Versions 8.3.5 and prior. An improper access control vulnerability may allow an attacker to cause a denial-of-service condition.https://patchthecve.com/cve/CVE-2019-6552.htmlhttps://patchthecve.com/cve/CVE-2019-6552.htmlWed, 17 Jun 2026 02:39:14 +0000CRITICAL 9.8: Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple command injection vulnerabilities, caused by a lack of proper validation of user-supplied data, may allow remote code execution.https://patchthecve.com/cve/CVE-2019-6550.htmlhttps://patchthecve.com/cve/CVE-2019-6550.htmlWed, 17 Jun 2026 02:39:14 +0000CRITICAL 9.8: Advantech WebAccess/SCADA, Versions 8.3.5 and prior. Multiple stack-based buffer overflow vulnerabilities, caused by a lack of proper validation of the length of user-supplied data, may allow remote code execution.https://patchthecve.com/cve/CVE-2018-15707.htmlhttps://patchthecve.com/cve/CVE-2018-15707.htmlWed, 17 Jun 2026 01:42:58 +0000MEDIUM 5.4: Advantech WebAccess 8.3.1 and 8.3.2 are vulnerable to cross-site scripting in the Bwmainleft.asp page. An attacker could leverage this vulnerability to disclose credentials amongst other things.https://patchthecve.com/cve/CVE-2018-15706.htmlhttps://patchthecve.com/cve/CVE-2018-15706.htmlWed, 17 Jun 2026 01:42:58 +0000MEDIUM 6.5: WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to read any file on the filesystem due to a directory traversal vulnerability in the readFile API.https://patchthecve.com/cve/CVE-2018-15705.htmlhttps://patchthecve.com/cve/CVE-2018-15705.htmlWed, 17 Jun 2026 01:42:58 +0000MEDIUM 6.5: WADashboard API in Advantech WebAccess 8.3.1 and 8.3.2 allows remote authenticated attackers to write or overwrite any file on the filesystem due to a directory traversal vulnerability in the writeFile API. An attacker can use this vulnerability to remotely execute arbitrary code.https://patchthecve.com/cve/CVE-2018-17910.htmlhttps://patchthecve.com/cve/CVE-2018-17910.htmlWed, 17 Jun 2026 01:46:30 +0000HIGH 7.8: WebAccess Versions 8.3.2 and prior. The application fails to properly validate the length of user-supplied data, causing a buffer overflow condition that allows for arbitrary remote code execution.https://patchthecve.com/cve/CVE-2018-17908.htmlhttps://patchthecve.com/cve/CVE-2018-17908.htmlWed, 17 Jun 2026 01:46:30 +0000HIGH 7.8: WebAccess Versions 8.3.2 and prior. During installation, the application installer disables user access control and does not re-enable it after the installation is complete. This could allow an attacker to run elevated arbitrary code.https://patchthecve.com/cve/CVE-2018-14828.htmlhttps://patchthecve.com/cve/CVE-2018-14828.htmlWed, 17 Jun 2026 01:41:43 +0000HIGH 7.8: Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files and perform actions at a system administrator level.https://patchthecve.com/cve/CVE-2018-14820.htmlhttps://patchthecve.com/cve/CVE-2018-14820.htmlWed, 17 Jun 2026 01:41:42 +0000HIGH 7.5: Advantech WebAccess 8.3.1 and earlier has a .dll component that is susceptible to external control of file name or path vulnerability, which may allow an arbitrary file deletion when processing.https://patchthecve.com/cve/CVE-2018-14816.htmlhttps://patchthecve.com/cve/CVE-2018-14816.htmlWed, 17 Jun 2026 01:41:41 +0000CRITICAL 9.8: Advantech WebAccess 8.3.1 and earlier has several stack-based buffer overflow vulnerabilities that have been identified, which may allow an attacker to execute arbitrary code.https://patchthecve.com/cve/CVE-2018-14806.htmlhttps://patchthecve.com/cve/CVE-2018-14806.htmlWed, 17 Jun 2026 01:41:40 +0000CRITICAL 9.8: Advantech WebAccess 8.3.1 and earlier has a path traversal vulnerability which may allow an attacker to execute arbitrary code.https://patchthecve.com/cve/CVE-2018-15704.htmlhttps://patchthecve.com/cve/CVE-2018-15704.htmlWed, 17 Jun 2026 01:42:58 +0000HIGH 8.8: Advantech WebAccess 8.3.2 and below is vulnerable to a stack buffer overflow vulnerability. A remote authenticated attacker could potentially exploit this vulnerability by sending a crafted HTTP request to broadweb/system/opcImg.asp.https://patchthecve.com/cve/CVE-2018-15703.htmlhttps://patchthecve.com/cve/CVE-2018-15703.htmlWed, 17 Jun 2026 01:42:58 +0000MEDIUM 6.1: Advantech WebAccess 8.3.2 and below is vulnerable to multiple reflected cross site scripting vulnerabilities. A remote unauthenticated attacker could potentially exploit this vulnerability by tricking a victim to supply malicious HTML or JavaScript code to WebAccess, which is then reflected back to https://patchthecve.com/cve/CVE-2018-8845.htmlhttps://patchthecve.com/cve/CVE-2018-8845.htmlWed, 17 Jun 2026 02:05:29 +0000CRITICAL 9.8: In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, a heap-based buffer overflow vulnerability has been identified, which may al