Due to insufficient sanitization, an attacker can upload a specially
crafted configuration file to cause a denial-of-service condition,
traverse directories, or read/write files, within the context of the
local system account.
Advantech has stated that the listed products are end-of-life, and
recommends all users upgrade their devices to DeviceOn, which is not
vulnerable to these vulnerabilities. For further questions or upgrade
assistance, users should contact Advantech https://www.advantech.com/emt/contact .
Configurations
Workarounds
Exploits
Credits
finder
Alex Williams of Pellera Technologies reported this vulnerability to CISA.