cbcvebase.
CVE-2019-3975
published 2019-09-10

CVE-2019-3975: Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603…

PriorityP265critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
4.57%
90.4th percentile
Stack-based buffer overflow in Advantech WebAccess/SCADA 8.4.1 allows a remote, unauthenticated attacker to execute arbitrary code via a crafted IOCTL 70603 RPC message.

Affected

2 ranges
VendorProductVersion rangeFixed in
advantechwebaccess——
advantechwebaccess_scada——

Detection & IOCsextracted from sources · hover to see the quote

otherIOCTL 70603 RPC message↗
otherIOCTL 70533 RPC message↗
pathC:\WebAccess\Node\viewsrv.dll↗
filenameBwPAlarm.dll↗
processwebvrpcs.exe↗
  • →Monitor for unauthenticated RPC calls targeting IOCTL code 70603 against Advantech WebAccess/SCADA (webvrpcs process); oversized payloads indicate exploitation of the stack buffer overflow. ↗
  • →Monitor for unauthenticated RPC calls targeting IOCTL code 70533 (decimal) against BwPAlarm.dll / webvrpcs; a large data payload overflows a fixed 0x800-byte stack buffer via vsprintf. ↗
  • →Detect EIP/instruction-pointer control via repeated 0x41 bytes (classic stack smash pattern) in the webvrpcs process — crash signature shows EIP=0x41414141. ↗
  • →Alert on DEP/access-violation exceptions (code 0xc0000005) originating from the webvrpcs process, particularly when the faulting address falls in an unknown module — indicative of ROP/shellcode execution. ↗
  • →The vulnerable call chain passes through RPCRT4 dispatch functions into webvrpcs; network-level detection should look for abnormally large RPC PDUs destined to the WebAccess/SCADA RPC endpoint. ↗
  • ·The NVD advisory references IOCTL 70603 for CVE-2019-3975 (affecting version 8.4.1), while Tenable's TRA-2019-52 documents a related but distinct IOCTL 70533 overflow found in version 8.4.2 during plugin development — treat these as two separate vulnerable code paths in the same product family. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.