PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9349 Advantech CVE debrief

CVE-2016-9349 is a high-severity information disclosure issue in Advantech SUISAccess Server version 3.0 and earlier. According to the NVD record, an attacker can traverse the file system and extract files, with the impact limited to confidentiality loss. The CVE was published on 2017-02-13 and was last modified on 2026-05-13.

Vendor
Advantech
Product
Susiaccess
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2016-09-04
Original CVE updated
2025-06-05
Advisory published
2016-09-04
Advisory updated
2025-06-05

Who should care

Operators, maintainers, and integrators using Advantech SUISAccess Server 3.0 or any earlier version should pay attention, especially if the service is reachable from untrusted networks or used in operational environments.

Technical summary

The NVD entry maps this issue to CWE-200 and rates it CVSS 3.0 7.5 High with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The supplied description says an attacker could traverse the file system and extract files, which indicates unauthorized access to sensitive local content rather than code execution or integrity impact.

Defensive priority

High. The vulnerability is network-reachable, requires no privileges or user interaction, and can expose sensitive files. Systems running affected versions should be reviewed promptly and constrained if they cannot be immediately remediated.

Recommended defensive actions

  • Inventory Advantech SUISAccess Server deployments and confirm whether any instance is version 3.0 or earlier.
  • Apply the mitigation guidance in the linked US-CERT/ICS advisory and vendor-related references.
  • Restrict network exposure of affected instances to trusted management networks only.
  • Monitor for unexpected file access or disclosure activity on affected hosts.
  • If the product cannot be promptly remediated, isolate or segment the system to reduce exposure to untrusted clients.

Evidence notes

The description, version scope, and CVSS vector come from the supplied NVD-derived record. Published and modified timing should be read from the CVE dates: 2017-02-13 published and 2026-05-13 modified. References in the supplied corpus include the CVE record, NVD detail page, US-CERT advisory ICSA-16-336-04, SecurityFocus BID 94629, and Exploit-DB entries 42401 and 42402; the corpus does not provide remediation details beyond the advisory links.

Sources and references

Verified primary and authoritative sources

  • CVE-2016-9349 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2016-9349

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2016-9349 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2016-9349

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.