Advantech WebAccess/SCADA

Multiple critical vulnerabilities discovered in Advantech WebAccess/SCADA version 9.2.1 affecting critical infrastructure sectors worldwide. Five CVEs identified including path traversal, unrestricted file upload, absolute path traversal, and SQL injection vulnerabilities with CVSS scores ranging from 4.3 to 8.8. Successful exploitation could allow authenticated attackers to read or modify remote databases, execute arbitrary code, delete files, or determine file existence. Vendor has released version 9.2.2 as a fix. Product is deployed globally in critical manufacturing, energy, and water/wastewater sectors. No known public exploitation reported at time of advisory publication.