CVE-2020-10625
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to create new administrator accounts in Advantech WebAccess/NMS network management software. Systems running versions prior to 3.0.2 are affected, potentially giving attackers full control over the network management platform.
💻 Affected Systems
- Advantech WebAccess/NMS
📦 What is this software?
Webaccess\/nms by Advantech
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of network management system, enabling attackers to reconfigure network devices, deploy malware across managed systems, and maintain persistent access to the entire network infrastructure.
Likely Case
Attackers create admin accounts to gain unauthorized access, potentially leading to network reconnaissance, data exfiltration, or deployment of ransomware across managed devices.
If Mitigated
With proper network segmentation and access controls, impact is limited to the WebAccess/NMS system itself, though attackers could still compromise network management functions.
🎯 Exploit Status
The vulnerability is simple to exploit - attackers can send crafted HTTP requests to create admin accounts without any authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.2
Vendor Advisory: https://www.advantech.com/support/details/firmware?id=1KXKJ8K8K8K8K8K8
Restart Required: Yes
Instructions:
1. Download WebAccess/NMS version 3.0.2 from Advantech support portal. 2. Backup current configuration. 3. Run the installer to upgrade to version 3.0.2. 4. Restart the WebAccess/NMS service.
🔧 Temporary Workarounds
Network Access Restriction
windowsRestrict network access to WebAccess/NMS to only trusted IP addresses using firewall rules.
Windows Firewall: New-NetFirewallRule -DisplayName "Block WebAccess External" -Direction Inbound -Protocol TCP -LocalPort 80,443 -RemoteAddress NotIn 192.168.1.0/24,10.0.0.0/8 -Action Block
Web Server IP Restriction
windowsConfigure IIS or web server to only accept connections from authorized IP ranges.
IIS: Use IP Address and Domain Restrictions module to allow only specific IP ranges
🧯 If You Can't Patch
- Immediately isolate WebAccess/NMS system from internet and restrict internal network access using firewall rules
- Implement strict monitoring for unauthorized admin account creation and review all existing admin accounts
🔍 How to Verify
Check if Vulnerable:
Check WebAccess/NMS version in the web interface or via the installed program version. If version is below 3.0.2, the system is vulnerable.Check Version:
Check via web interface at http://[server]:80 or via Windows Programs and FeaturesVerify Fix Applied:
After patching, verify version shows 3.0.2 and attempt to access the admin account creation endpoint (if known) to confirm it requires authentication.📡 Detection & Monitoring
Log Indicators:
- Unusual admin account creation events
- Failed authentication attempts followed by successful admin creation
- HTTP POST requests to user creation endpoints from unauthorized IPs
Network Indicators:
- HTTP POST requests to /api/user/create or similar endpoints without authentication headers
- Traffic to WebAccess/NMS from unexpected source IPs
SIEM Query:
source="webaccess_logs" AND (event_type="user_creation" OR uri_path="/api/user*") AND NOT user="authenticated_admin"