CVE-2021-32956 Open redirect in Advantech WebAccess/SCADA

Medium 6.1 Published 18 Jun 2021 Updated 3 Aug 2024

Attackers can redirect users to malicious webpages via crafted URLs in Advantech WebAccess/SCADA, potentially facilitating phishing attacks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2021-32956?

CVE-2021-32956 is a medium-severity vulnerability in Advantech WebAccess/SCADA, published on 18 Jun 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Advantech WebAccess/SCADA Versions 9.0.1 and prior is vulnerable to redirection, which may allow an attacker to send a maliciously crafted URL that could result in redirecting a user to a malicious webpage.

Weakness: CWE-601

Which versions are affected by CVE-2021-32956?

It affects 1 product.

Products include Advantech Webaccess\/Scada.

How do I fix CVE-2021-32956?

No fix has been published for CVE-2021-32956 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-32956 being exploited?

There is no known exploitation of CVE-2021-32956 in the wild and no public exploit code.

Sources

Also known as GHSA-qwg3-2x2m-xw4g.