Executive brief
Advantech WebAccess/SCADA, a software suite used for monitoring and controlling industrial automation systems, is vulnerable to a security flaw in its administrative dashboard. An attacker can trick a user into executing malicious scripts by providing specially crafted input in the 'Create New Project User' section. If successful, this could allow an attacker to steal session information, access sensitive industrial data, or perform unauthorized actions on behalf of the victim user.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in Advantech WebAccess/SCADA version 8.0-2015.08.16. The vulnerability is located within the Admin Dashboard's 'Create New Project User' component, specifically in the 'decryption' field. The application fails to sufficiently sanitize or encode user-controlled input before rendering it in the browser. A remote attacker can exploit this by providing a malicious payload (e.g., using SVG onload events) that executes JavaScript in the context of an authenticated user's session. This can lead to session hijacking via cookie theft or unauthorized information disclosure. Mitigation involves implementing proper output encoding, input validation, and enforcing a strict Content Security Policy (CSP).
Affected products
- Advantech WebAccess/SCADA 8.0-2015.08.16
Timeline
- 2026-05-22: advisory: Initial disclosure and NVD publication
- 2026-05-22: other: Public Proof of Concept released on GitHub