Medium severity · published Mar 21, 2024
CVE-2024-2453
Advantech WebAccess/SCADA SQL Injection
6.4
CVSS
0.3%
EPSS
No
On KEV
Description
There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the database. Successful exploitation of this vulnerability could allow an attacker to read or modify data on the remote database.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WE
WebAccess/SCADA · Advantech
9.1.5U · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-2453
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-2453
www.cisa.gov
https://www.cisa.gov/news-events/ics-advisories/icsa-24-081-01
More from WebAccess/SCADA
9.8
CVE-2025-14849
Advantech WebAccess/SCADA Unrestricted Upload of File with Dangerous Type
9.8
CVE-2023-1437
No description published yet
9.8
CVE-2023-32540
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the operating system…
9.8
CVE-2023-32628
In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file upload vulnerability that could allow an attacker to modify the file extension of a certificate file to…
9.8
CVE-2021-32943
The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute arbitrary code on the WebAccess/SCADA (WebAccess/SCADA…