CVE-2017-16720: Advantech WebAccess path traversal exposes device files

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with network reachability, no authentication, and a public exploit plus high EPSS probability make this a high-urgency issue for exposed WebAccess deployments.

What it is

Advantech WebAccess versions 8.3.2 and earlier contain a path traversal flaw (CWE-22) that lets an attacker reach files within the target device's directory structure. The vulnerability is remotely reachable with no authentication or user interaction, and the record carries a critical CVSS 3.0 score of 9.8. It matters because WebAccess is an HMI/SCADA product, so exposed file access on a control-system host can lead to data disclosure and further compromise.

Impact

An attacker gains read access to files on the target device, which can expose configuration, credential or project data used by the SCADA/HMI environment. The CVSS vector also rates integrity and availability impact as high, though the description only confirms file access.

Attack surface

The flaw is network-reachable (AV:N) with low complexity, no privileges and no user interaction (PR:N/UI:N), so any host that can reach the WebAccess service can attempt it. No authentication is required per the vector.

Exploitation

A public exploit exists in Exploit-DB (EDB-44278), and EPSS estimates a 30-day exploitation probability of about 0.50 (98.9th percentile). The CVE is not listed in CISA KEV, and no ransomware groups are documented as using it.

What to do

• Upgrade Advantech WebAccess to a version later than 8.3.2; the record does not name a fixed release, so confirm with the vendor.
• Restrict network access to the WebAccess service to trusted management hosts and block it from untrusted networks and the internet.
• Run the WebAccess service with least privilege and isolate the host on a segmented control network.
• Monitor the vendor and ICS-CERT advisory channels for updated guidance, since the referenced ICS-CERT advisory link is broken.

Detection

• Inspect web server and application logs for traversal sequences such as ../ or encoded variants in request paths.
• Alert on unexpected reads of files outside the WebAccess web root or project directories.
• Baseline normal file access by the WebAccess process and flag deviations, especially reads of configuration or credential files.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.