VulnerabilityDeferred

CVE-2024-2453

There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database.

MEDIUM 6.4EPSS 0.30%

Does this matter?

Lower severity and a low EPSS score (0.30%). Track it; it rarely justifies an emergency change on its own.

Description

There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database.

CVSS 3.1: 6.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS: 0.30% probability · 23th percentile
CISA KEV: Not listed
Weakness: CWE-89
Source: ics-cert@hq.dhs.gov

References

https://www.cisa.gov/news-events/ics-advisories/icsa-24-081-01
https://www.cisa.gov/news-events/ics-advisories/icsa-24-081-01

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.