CVE-2021-22676: Advantech Webaccess/scada

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

UserExcelOut.asp within WebAccess/SCADA is vulnerable to cross-site scripting (XSS), which could allow an attacker to send malicious JavaScript code. This could result in hijacking of cookie/session tokens, redirection to a malicious webpage, and unintended browser action on the WebAccess/SCADA (WebAccess/SCADA versions prior to 8.4.5, WebAccess/SCADA versions prior to 9.0.1).

Affected products

• Advantech Webaccess/scada: before 8.4.5 (fixed in 8.4.5); from 9.0, before 9.0.1 (fixed in 9.0.1)

Published 2021-08-10. Last modified 2026-06-17.