← Vulnerability feed

Vulnerability record · CVE-2021-38431 · published 15 October 2021

CVE-2021-38431: Advantech webaccess scada missing authorization vulnerability

Advantech · Webaccess Scada

An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users.

4.3 CVSS 3.1 Medium EPSS 0.70% · top 48.8% CWE-862 · Missing authorization
4.3CVSS 3.1 base score, v2 4.0
0.70%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths from other users.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://us-cert.cisa.gov/ics/advisories/icsa-21-285-01 Third Party AdvisoryUS Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-21-285-01 Third Party AdvisoryUS Government Resource

Track CVE-2021-38431 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-10589Advantech webaccess path traversal vulnerabilityIn Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAcc…EPSS 4.0%9.8CVE-2018-7497Advantech webaccess null pointer dereference vulnerabilityIn Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAcc…EPSS 2.8%9.8CVE-2018-7499Advantech webaccess stack-based buffer overflow vulnerabilityIn Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAcc…EPSS 3.7%9.8CVE-2018-7505Advantech webaccess permissions and access controls vulnerabilityIn Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAcc…EPSS 2.8%9.8CVE-2018-8845Advantech webaccess heap-based buffer overflow vulnerabilityIn Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAcc…EPSS 5.6%7.8CVE-2018-8841Advantech webaccess improper privilege management vulnerabilityIn Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAcc…EPSS 0.36%7.5CVE-2018-10590Advantech webaccess vulnerabilityIn Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAcc…EPSS 1.7%7.5CVE-2018-7495Advantech webaccess path traversal vulnerabilityIn Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAcc…EPSS 2.2%

Source: NIST National Vulnerability Database (record CVE-2021-38431), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.