CVE-2021-33023
Advantech WebAccess
02 Description
Advantech WebAccess
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 2.34% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 83.1% of scored records. A rank, not a probability.
- NVD base score
- 9.8 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2021-10-18 12:41Z5 YR AGO
- Last updated
- 2024-09-17 03:49Z2 YR AGO
- Reserved
- 2021-05-13
- Assigning CNA
- icscert
- Record state
- PUBLISHED
- Severity
- Critical (CVSS 9.8)
- CNA CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- Data version
- 5.1
- Document digest
- 39d92ef3711b85c981823988c020d15a529a718718fddf82de3e743f425e4599
05 Affected products
06 References
- us-cert.cisa.govhttps://us-cert.cisa.gov/ics/advisories/icsa-21-285-02
07 Remediation
In order to address the heap-based buffer overflow vulnerability, Advantech recommends users directly add the remote access code to avoid being attacked by unknown requests. This is the remote access code established during installation of the Advantech WebAccess SCADA software (SCADA node, project node, or OPC Service) on the OPC Server computer. The access code you enter here must match the remote access code established during installation on the OPC Server. This prevents unauthorized users from accessing the OPC Server data using the Advantech WebAccess SCADA OPC Service. If you have forgotten the remote access code using during software installation on the OPC Server node, you have two options: Re-install the Advantech WebAccess SCADA software on the OPC Server node to change it and edit it to match in your database. Edit the BWSERVER.INI file on the OPC Server node and edit it to match in your database using UPDATE.