PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-9349 Advantech CVE debrief

CVE-2016-9349 is a high-severity information disclosure issue in Advantech SUISAccess Server version 3.0 and earlier. According to the NVD record, an attacker can traverse the file system and extract files, with the impact limited to confidentiality loss. The CVE was published on 2017-02-13 and was last modified on 2026-05-13.

Vendor
Advantech
Product
CVE-2016-9349
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-13
Original CVE updated
2026-05-13
Advisory published
2017-02-13
Advisory updated
2026-05-13

Who should care

Operators, maintainers, and integrators using Advantech SUISAccess Server 3.0 or any earlier version should pay attention, especially if the service is reachable from untrusted networks or used in operational environments.

Technical summary

The NVD entry maps this issue to CWE-200 and rates it CVSS 3.0 7.5 High with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The supplied description says an attacker could traverse the file system and extract files, which indicates unauthorized access to sensitive local content rather than code execution or integrity impact.

Defensive priority

High. The vulnerability is network-reachable, requires no privileges or user interaction, and can expose sensitive files. Systems running affected versions should be reviewed promptly and constrained if they cannot be immediately remediated.

Recommended defensive actions

  • Inventory Advantech SUISAccess Server deployments and confirm whether any instance is version 3.0 or earlier.
  • Apply the mitigation guidance in the linked US-CERT/ICS advisory and vendor-related references.
  • Restrict network exposure of affected instances to trusted management networks only.
  • Monitor for unexpected file access or disclosure activity on affected hosts.
  • If the product cannot be promptly remediated, isolate or segment the system to reduce exposure to untrusted clients.

Evidence notes

The description, version scope, and CVSS vector come from the supplied NVD-derived record. Published and modified timing should be read from the CVE dates: 2017-02-13 published and 2026-05-13 modified. References in the supplied corpus include the CVE record, NVD detail page, US-CERT advisory ICSA-16-336-04, SecurityFocus BID 94629, and Exploit-DB entries 42401 and 42402; the corpus does not provide remediation details beyond the advisory links.

Official resources

Publicly disclosed in the CVE/NVD record on 2017-02-13; the record was modified on 2026-05-13. This debrief uses only the supplied official record and reference metadata.