Advantech WISE-PaaS/RMM, Versions 3.3.29 and prior. Path traversal vulnerabilities are caused by a lack of proper validation of a user-supplied path prior to use in file operations. An attacker can leverage these vulnerabilities to remotely execute code while posing as an administrator.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
| Link | Tags |
|---|---|
| https://www.us-cert.gov/ics/advisories/icsa-19-304-01 | us government resource third party advisory mitigation |
| https://www.zerodayinitiative.com/advisories/ZDI-19-935/ | third party advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-19-950/ | third party advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-19-941/ | third party advisory |
| https://www.zerodayinitiative.com/advisories/ZDI-19-958/ | third party advisory |