PT-2021-14788 · Advantech · Advantech R-Seenet

Published 2021-08-05 · Updated 2022-09-30 · CVE-2021-21805

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet version 2.4.12

Description An OS Command Injection issue exists in the ping.php script functionality. A specially crafted HTTP request can lead to arbitrary OS command execution. An attacker can send a crafted HTTP request to trigger this issue.

Recommendations For Advantech R-SeeNet version 2.4.12, consider disabling the ping.php script functionality until a patch is available. Restrict access to the ping.php script to minimize the risk of exploitation. Avoid using the vulnerable functionality in the ping.php script until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-21805

Affected Products

Advantech R-Seenet

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1274 · Exploit
• https://osv.dev/vulnerability/CVE-2021-21805 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21805 · Security Note
• https://t.me/cvenotify/18753 · Telegram Post
• https://t.me/cvenotify/36965 · Telegram Post