CVE-2017-16720

published 2018-01-05

CVE-2017-16720: A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within the directory structure of the target…

Priority P2 75 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier. An attacker has access to files within the directory structure of the target device.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
advantech	webaccess	<= 8.3.2	—

Detection & IOCs extracted from sources · hover to see the quote

port 4592↗

other 5d2b62aa-ee0a-4a95-91ae-b064fdb471fc↗

process webvrpcs.exe↗

command ..\..\windows\system32\calc.exe↗

path C:\WebAccess\Node\net.exe↗

path bwcfg.mdb↗

• → Detect unauthenticated DCERPC bind attempts to interface UUID 5d2b62aa-ee0a-4a95-91ae-b064fdb471fc on TCP port 4592, which is the attack vector for CVE-2017-16720 against webvrpcs.exe. ↗
• → Monitor for IOCTL 0x2711 (decimal 10001) RPC calls to webvrpcs.exe on port 4592, which is used to pass path-traversal command strings to CreateProcessA(). ↗
• → Alert on IOCTL 10005 RPC calls to webvrpcs.exe, which trigger an unauthenticated arbitrary file deletion (_unlink) primitive. ↗
• → Detect path-traversal sequences (e.g., ..\..\) in RPC stub data sent to TCP port 4592, indicative of directory traversal exploitation of webvrpcs.exe. ↗
• → Monitor webvrpcs.exe for spawning child processes with administrator privileges, as the service runs with administrator access rights and can be abused for RCE. ↗
• → Watch for unauthenticated RPC file-operation calls (fopen/fwrite/fclose) to webvrpcs.exe that write executables into C:\WebAccess\Node\ — a whitelisted directory used to bypass the CVE-2017-16720 patch. ↗

• · The ICS-CERT advisory stated WebAccess 8.3 addressed CVE-2017-16720, but Tenable confirmed versions 8.3, 8.3.1, and 8.3.2 remain vulnerable — patching to 8.3 is insufficient. ↗
• · The 8.3.3 patch introduced an executable whitelist in DsDaqWebService (drawsrv.dll) to restrict CreateProcessA() calls, but this whitelist can be bypassed by uploading a malicious file to a whitelisted path via unauthenticated RPC file-write operations. ↗
• · webvrpcs.exe accepts unauthenticated RPC calls for file operations (fopen, fseek, ftell, fread, fwrite, fclose), meaning network-level access controls blocking port 4592 are critical compensating controls. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22