350
CVEs
95
Critical
142
High
0
KEV
75
PoC
218
Unpatched C/H
12.0%
Patch Rate
4.1%
Avg EPSS
Severity Breakdown
CRITICAL
95
HIGH
142
MEDIUM
111
LOW
2
Monthly CVE Trend
Affected Products (30)
Webaccess
94
R Seenet
40
Advantech Webaccess
38
Iview
36
Webaccess Scada
30
Eki 6333Ac 2G Firmware
20
Eki 6333Ac 2Gd Firmware
20
Eki 6333Ac 1Gpo Firmware
20
Webaccess Nms
20
Webaccess Hmi Designer
18
Webaccess Vpn
12
Webaccess Dashboard
11
Wise Deviceon Server
11
PHP
8
Wise 4050lan Firmware
8
Wise 4010lan Firmware
8
Wise 4060lan Firmware
8
Eki 1524 Firmware
5
Eki 1522 Firmware
5
Eki 1521 Firmware
5
Wise Paas Rmm
5
Adam 3600 Edgelink
5
Deviceon Iedge
4
Adam 5630 Firmware
3
Susiaccess
3
Wise 6610 Jb
2
Wise 6610 El Cb
2
Wise 6610P Dna
2
Iot Edge Linux Docker
2
Wise 6610 El Eb
2
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2016-0854 | Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 72.2%. | CRITICAL | 9.8 | 72.2% | 156 |
PoC
No patch
|
| CVE-2014-0763 | An attacker using SQL injection may use arguments to construct queries without proper sanitization. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 57.9%. | HIGH | 7.5 | 57.9% | 115 |
PoC
No patch
|
| CVE-2014-2364 | Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 40.2%. | HIGH | 7.5 | 40.2% | 113 |
PoC
No patch
|
| CVE-2016-0856 | Multiple stack-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 51.5% and no vendor patch available. | CRITICAL | 9.8 | 51.5% | 100 |
No patch
|
| CVE-2014-9208 | Multiple stack-based buffer overflows in unspecified DLL files in Advantech WebAccess before 8.0.1 allow remote attackers to execute arbitrary code via unknown vectors. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 22.3%. | CRITICAL | 10.0 | 22.3% | 92 |
PoC
No patch
|
| CVE-2017-14016 | A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 19.2%. | MEDIUM | 6.3 | 19.2% | 86 |
PoC
No patch
|
| CVE-2014-8386 | Multiple stack-based buffer overflows in Advantech AdamView 4.3 and earlier allow remote attackers to execute arbitrary code via a crafted (1) display properties or (2) conditional bitmap parameter. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 27.9%. | HIGH | 7.5 | 27.9% | 85 |
PoC
No patch
|
| CVE-2021-22652 | Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 36.8% | 84 |
PoC
No patch
|
| CVE-2022-2143 | The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 59.2% | 84 |
PoC
No patch
|
| CVE-2025-52694 | Critical SQL injection vulnerability in an internet-exposed service enabling unauthenticated extraction and manipulation of the entire database. CVSS 10.0 with scope change, EPSS 12.9% indicating high exploitation activity. | CRITICAL | 10.0 | 12.9% | 83 |
PoC
No patch
|
| CVE-2016-9349 | An issue was discovered in Advantech SUISAccess Server Version 3.0 and prior. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 23.7%. | HIGH | 7.5 | 23.7% | 81 |
PoC
No patch
|
| CVE-2014-8387 | cgi/utility.cgi in Advantech EKI-6340 2.05 Wi-Fi Mesh Access Point allows remote authenticated users to execute arbitrary commands via shell metacharacters in the pinghost parameter to ping.cgi. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 13.4%. | CRITICAL | 9.0 | 13.4% | 78 |
PoC
No patch
|
| CVE-2012-0242 | Format string vulnerability in Advantech/BroadWin WebAccess before 7.0 allows remote attackers to execute arbitrary code via format string specifiers in a message string. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available. | CRITICAL | 10.0 | 6.3% | 76 |
PoC
|
| CVE-2016-5810 | upAdminPg.asp in Advantech WebAccess before 8.1_20160519 allows remote authenticated administrators to obtain sensitive password information via unspecified vectors. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 25.4%. | MEDIUM | 4.9 | 25.4% | 70 |
PoC
No patch
|
| CVE-2018-6911 | The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument (aka the command parameter). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available. | CRITICAL | 9.8 | 13.0% | 69 |
PoC
No patch
|