CVE-2020-10631
📋 TL;DR
This vulnerability allows attackers to perform directory traversal attacks on Advantech WebAccess/NMS systems, enabling unauthorized file deletion or reading outside the intended directory structure. Systems running WebAccess/NMS versions prior to 3.0.2 are affected, potentially exposing sensitive configuration files and system data.
💻 Affected Systems
- Advantech WebAccess/NMS
📦 What is this software?
Webaccess\/nms by Advantech
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files or exfiltration of sensitive configuration data, potentially leading to operational disruption and data breach.
Likely Case
Unauthorized access to sensitive configuration files, credential theft, and potential modification of system files affecting operational integrity.
If Mitigated
Limited impact with proper network segmentation and access controls, though the vulnerability remains present in the software.
🎯 Exploit Status
Directory traversal vulnerabilities are well-understood and easily weaponized. The CVSS score of 9.8 indicates high exploitability with low complexity.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.2
Vendor Advisory: https://www.advantech.com/support/details/firmware?id=1KJKA3S1KJ
Restart Required: Yes
Instructions:
1. Download WebAccess/NMS version 3.0.2 from Advantech's official website. 2. Backup current configuration and data. 3. Run the installer to upgrade to version 3.0.2. 4. Restart the WebAccess/NMS service and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
allIsolate WebAccess/NMS systems from untrusted networks and implement strict firewall rules.
Access Control Lists
windowsImplement strict file system permissions to limit what the WebAccess/NMS service account can access.
icacls C:\WebAccess\NMS /deny WEBSERVICE:(OI)(CI)(DE,WDAC,WO)
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to WebAccess/NMS only from trusted IP addresses.
- Deploy web application firewall (WAF) rules to block directory traversal patterns (../, ..\, etc.) in URLs.
🔍 How to Verify
Check if Vulnerable:
Check the WebAccess/NMS version in the web interface or installation directory. Versions below 3.0.2 are vulnerable.Check Version:
Check the version.txt file in the WebAccess/NMS installation directory or view the version in the web interface.Verify Fix Applied:
Verify the version shows 3.0.2 or higher in the web interface or About dialog. Test with controlled directory traversal attempts that should be blocked.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' or '..\' patterns in URLs
- Unauthorized file access attempts in application logs
- Failed authentication attempts followed by directory traversal patterns
Network Indicators:
- HTTP requests with encoded directory traversal sequences (%2e%2e%2f, %2e%2e%5c)
- Unusual file access patterns from single IP addresses
SIEM Query:
source="webaccess_logs" AND (url="*../*" OR url="*..\\*" OR url="*%2e%2e%2f*" OR url="*%2e%2e%5c*")