CVE-2018-7505
📋 TL;DR
This vulnerability allows unauthenticated attackers to upload arbitrary files via TFTP to Advantech WebAccess systems, potentially leading to remote code execution. It affects multiple WebAccess products and versions, primarily industrial control systems used in critical infrastructure.
💻 Affected Systems
- Advantech WebAccess
- Advantech WebAccess Dashboard
- Advantech WebAccess Scada Node
- Advantech WebAccess/NMS
📦 What is this software?
Webaccess by Advantech
Webaccess by Advantech
Webaccess\/nms by Advantech
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, disrupt industrial processes, steal sensitive data, or pivot to other network systems.
Likely Case
Unauthorized file upload leading to web shell deployment, data exfiltration, or denial of service against the SCADA/HMI system.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external TFTP access to vulnerable systems.
🎯 Exploit Status
TFTP protocol inherently lacks authentication, making exploitation trivial once the vulnerability is understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: WebAccess 8.3.1, Dashboard 2.0.16, NMS 2.0.4
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSA-18-135-01
Restart Required: Yes
Instructions:
1. Download updated versions from Advantech support portal. 2. Backup configuration and data. 3. Install updates following vendor documentation. 4. Restart services/systems as required.
🔧 Temporary Workarounds
Block TFTP Port
allBlock UDP port 69 (TFTP) at network perimeter and internal firewalls
Windows Firewall: New-NetFirewallRule -DisplayName "Block TFTP" -Direction Inbound -Protocol UDP -LocalPort 69 -Action Block
Linux iptables: iptables -A INPUT -p udp --dport 69 -j DROP
Disable TFTP Service
windowsStop and disable TFTP service on affected systems
sc stop "Advantech TFTP"
sc config "Advantech TFTP" start= disabled
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WebAccess systems from untrusted networks
- Deploy application whitelisting to prevent execution of unauthorized files
🔍 How to Verify
Check if Vulnerable:
Check installed version against affected versions list. Test TFTP access: 'tftp <target_ip> put test.txt' from external/internal network.Check Version:
Check WebAccess About dialog or registry: HKEY_LOCAL_MACHINE\SOFTWARE\Advantech\WebAccess\VersionVerify Fix Applied:
Verify version is updated to patched versions. Attempt TFTP file upload should fail with access denied or service unavailable.📡 Detection & Monitoring
Log Indicators:
- TFTP service logs showing file uploads from unauthorized sources
- Windows event logs showing unexpected process execution
Network Indicators:
- UDP port 69 traffic to WebAccess systems
- TFTP PUT requests from unexpected sources
SIEM Query:
source_port=69 OR dest_port=69 AND protocol=UDP AND (event_type="file_upload" OR command="PUT")