Advantech WebAccess Multiple Vulnerabilities

Summary
This host is running Advantech WebAccess and is prone to multiple vulnerabilities.
Impact
Successful exploitation will allow attackers to conduct SQL injection attacks, bypass certain security restrictions, and compromise a user's system. Impact Level: Application
Solution
Upgrade to Advantech WebAccess 7.2 or later, For updates refer to http://webaccess.advantech.com
Insight
- Certain input related to some SOAP requests is not properly sanitised within the DBVisitor.dll component before being used in a SQL query. - Multiple boundary errors within the webvact.ocx ActiveX control when handling GotoCmd, NodeName2, AccessCode, UserName, and NodeName strings can be exploited to cause stack-based buffer overflows. - A boundary error within the webvact.ocx ActiveX control when handling the AccessCode2 string can be exploited to cause a stack-based buffer overflow. - Two errors within the 'OpenUrlToBuffer()' and 'OpenUrlToBufferTimeout()' methods of the BWOCXRUN.BwocxrunCtrl.1 ActiveX control can be exploited to disclose contents of arbitrary local or network resources. - An error within the 'CreateProcess()' method of the BWOCXRUN.BwocxrunCtrl.1 ActiveX control can be exploited to bypass the intended restrictions and subsequently execute arbitrary code.
Affected
Advantech WebAccess before 7.2
Detection
Get the installed version of Advantech WebAccess with the help of detect NVT and check the version is vulnerable or not.
References