Vulnerability · Published Feb 17, 2021 · Assigned by talos

CVE-2020-13552

High 8.8

In plain English

A high-severity incorrect default permissions in Advantech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).

Severity (CVSS 3.0)8.8High

Exploit odds (30 days)0.5%top 56.7% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

An exploitable local privilege elevation vulnerability exists in the file system permissions of Advantech WebAccess/SCADA 9.0.1 installation. In privilege escalation via multiple service executables in installation folder of WebAccess, an attacker can either replace binary or loaded modules to execute code with NT SYSTEM privilege.

Affected products (as reported)

Vendor	Product	Versions
n/a	Advantech	Advantech WebAccess/SCADA 9.0.1

Weakness: CWE-276 · Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

References

https://talosintelligence.com/vulnerability_reports/TALOS-2020-1169 x_refsource_MISC