CVE-2023-32540 Code injection in WebAccess/SCADA

High 7.2 Published 5 Jun 2023 Updated 8 Jan 2025

Attackers can overwrite arbitrary files and inject code into XLS files in Advantech WebAccess/SCADA, leading to arbitrary code execution.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-32540?

CVE-2023-32540 is a high-severity code injection vulnerability in Advantech WebAccess/SCADA, published on 5 Jun 2023. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

In Advantech WebAccss/SCADA v9.1.3 and prior, there is an arbitrary file overwrite vulnerability, which could allow an attacker to overwrite any file in the operating system (including system files), inject code into an XLS file, and modify the file extension, which could lead to arbitrary code execution.

Weakness: CWE-94

Which versions are affected by CVE-2023-32540?

It affects 1 product.

Products include Advantech Webaccess\/Scada.

How do I fix CVE-2023-32540?

No fix has been published for CVE-2023-32540 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-32540 being exploited?

There is no known exploitation of CVE-2023-32540 in the wild and no public exploit code.

Sources

Also known as GHSA-g8xw-m45c-jphf.