CVE-2021-42706
📋 TL;DR
CVE-2021-42706 is a use-after-free vulnerability in Advantech WebAccess/MHI Designer that could allow remote attackers to execute arbitrary code or disclose sensitive information. Affected systems include installations of WebAccess/MHI Designer software used in industrial control systems.
💻 Affected Systems
- Advantech WebAccess/MHI Designer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attacker to execute arbitrary code with system privileges, potentially leading to operational disruption, data theft, or lateral movement within industrial networks.
Likely Case
Remote code execution leading to unauthorized access to the affected system, potentially allowing attackers to manipulate industrial processes or steal sensitive data.
If Mitigated
Limited impact if system is isolated from untrusted networks and proper access controls are implemented, though the vulnerability still exists in the software.
🎯 Exploit Status
The vulnerability can be exploited remotely without authentication, making it relatively easy to weaponize once exploit details become public.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 9.0.3
Vendor Advisory: https://us-cert.cisa.gov/ics/advisories/icsa-21-173-01
Restart Required: Yes
Instructions:
1. Download WebAccess/MHI Designer version 9.0.3 or later from Advantech's official website. 2. Backup current configuration and data. 3. Install the update following vendor instructions. 4. Restart the system to complete installation.
🔧 Temporary Workarounds
Network Segmentation
allIsolate WebAccess/MHI Designer systems from untrusted networks and the internet
Firewall Restrictions
allImplement strict firewall rules to limit access to WebAccess/MHI Designer ports
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems from untrusted networks
- Deploy application whitelisting to prevent execution of unauthorized code
🔍 How to Verify
Check if Vulnerable:
Check WebAccess/MHI Designer version in the software interface or installation directoryCheck Version:
Check the software version through the application's Help > About menu or examine installation propertiesVerify Fix Applied:
Verify that WebAccess/MHI Designer version is 9.0.3 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual process creation events
- Unexpected network connections from WebAccess processes
- Access violations or memory errors in application logs
Network Indicators:
- Unusual traffic patterns to/from WebAccess ports
- Suspicious payloads targeting WebAccess services
SIEM Query:
source="webaccess" AND (event_type="process_creation" OR event_type="network_connection") AND dest_port IN (80, 443, 8080)