CVE-2017-16720

Think of WebAccess like a service that lets people fetch files for automation tasks. This bug lets an attacker use “trick” paths to escape to other files nearby on the device, not just the intended ones—like walking out the back door of a locked room to reach storage and utilities. If the attacker can write or disrupt, that can break operations and potentially expose or modify important data.

This matters if you run or manage Advantech WebAccess (webaccess), especially on versions 8.3.2 and earlier. It becomes a real risk when the vulnerable service can be reached by an attacker (for example, via internet access or any external remote connection), because the weakness does not require user interaction.
Only treat it as urgent if WebAccess is reachable from outside your internal network.

This is RED because there is public exploit code available and the likelihood is trending upward. If your WebAccess is reachable from an attacker, the path traversal can enable file reading and changing, which can directly lead to compromise and disruption.

1. Confirm exposure
   • Identify the exact Advantech WebAccess version running on your systems.
   • Confirm whether the WebAccess service is reachable from outside your network (for example, any inbound firewall rule, port-forwarding, VPN access that could be reached by an attacker, or other external exposure).
2. Prioritize mitigation based on reachability
   • If WebAccess is internet-reachable: treat as immediately exploitable and move upgrade ahead of everything else.
   • If it is only reachable from your internal network: upgrade still matters, but you can also tighten access rules and monitoring while patching.
3. Upgrade to the fixed version
   • Vendor fix: upgrade to WebAccess Version 8.3.
   • Get it from Advantech’s WebAccess download page (registration required): http://www.advantech.com/industrial-automation/webaccess/download
4. Validate after upgrade
   • Re-check that the installed version is now Version 8.3 (or later, if the vendor provides newer releases beyond 8.3).
   • Confirm WebAccess functionality still works for your normal use cases.
5. Temporary workaround (if you cannot patch right away)
   • Reduce exposure immediately by blocking external access to WebAccess and removing any unnecessary inbound firewall rules.
   • If remote access is required, restrict it to trusted networks and authenticated VPNs where possible.
6. What to monitor
   • Look for unusual requests to file paths or repeated access attempts that don’t match your normal WebAccess usage.
   • Monitor for unexpected file changes or service instability around the time of any suspicious access attempts.

Note: KEV was not listed in CISA KEV for this CVE based on the provided findings, so confirm exploitation status by checking your own logs rather than relying on KEV for this one.

Severity is high (critical) due to path traversal (CWE-22) in Advantech WebAccess versions 8.3.2 and earlier. The mechanism is file path manipulation: an attacker crafts requests so the application reads (and potentially writes) files outside the intended directories on the target system. The findings indicate public exploit availability (at least one known public exploit), which increases practical risk. KEV is not listed, so CISA’s known-exploited catalog does not confirm widespread exploitation for this CVE in the provided data; however, press attention is described as rising and exploitation code exists.

In practical terms for defenders: focus on (1) whether the service is externally reachable and (2) whether you can quickly upgrade to WebAccess Version 8.3. Public exploit code and rising attention make delays more dangerous. EPSS is provided as a prediction, but it should not be treated as proof of active exploitation.