CVE-2023-1437: CVE-2023-1437

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-02 · updated 2026-06-17
Weakness: CWE-822

Description

All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute commands and overwrite files.

Affected products

Advantech Webaccess/Scada: before 9.1.4 — fixed in 9.1.4

How to fix

Upgrade to a fixed version: Advantech Webaccess/Scada 9.1.4. Check the vendor advisory for mitigations.

References

https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-02
https://www.cisa.gov/news-events/ics-advisories/icsa-23-166-02

Get alerted when CVE-2023-1437 or the next vulnerability affects your stack