CVE-2019-3940

published 2019-04-09

CVE-2019-3940: Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call. An unauthenticated, remote attacker can use this vulnerability to…

Priority P2 63 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

Advantech WebAccess 8.3.4 is vulnerable to file upload attacks via unauthenticated RPC call. An unauthenticated, remote attacker can use this vulnerability to execute arbitrary code.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
advantech	webaccess	—	—

Detection & IOCs extracted from sources · hover to see the quote

path C:\WebAccess\Node\net.exe↗

filename bwcfg.mdb↗

process webvrpcs.exe↗

command IOCTL 10001↗

command IOCTL 10005↗

• → Monitor for unauthenticated RPC calls to webvrpcs.exe performing file operations (fopen, fseek, ftell, fread, fwrite, fclose) — these are the primitive operations used for both file upload (CVE-2019-3940) and file download (CVE-2019-3942). ↗
• → Alert on creation or modification of whitelisted executables in C:\WebAccess\Node\ (e.g., net.exe) by non-standard processes, as attackers upload malicious binaries to these paths to bypass the CreateProcessA whitelist. ↗
• → Detect IOCTL 10001 RPC calls originating from unauthenticated sessions to drawsrv.dll/DsDaqWebService, which are used to trigger process execution of attacker-uploaded files. ↗
• → Detect IOCTL 10005 RPC calls to webvrpcs.exe from unauthenticated sources, which map to the _unlink file deletion primitive. ↗

• · The whitelist bypass is only possible because the default installation leaves C:\WebAccess\Node\net.exe absent from the filesystem despite being whitelisted. Verify that no unexpected executables exist in WebAccess Node directories. ↗
• · The whitelist mechanism in DsDaqWebService (drawsrv.dll) was introduced in version 8.3.3 as a fix for CVE-2017-16720 but is bypassable via the unauthenticated file-upload primitive in webvrpcs.exe. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434