PT-2021-15150 · Advantech · Iview

William Vu · Published 2021-02-11 · Updated 2021-03-26 · CVE-2021-22652

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech iView versions prior to 5.7.03.6112

Description The issue concerns missing authentication in the configuration access of the affected software, potentially allowing an unauthorized attacker to modify the configuration and achieve code execution.

Recommendations For versions prior to 5.7.03.6112, update to version 5.7.03.6112 or later to resolve the issue.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-22652

Affected Products

Iview

References · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/advantech_iview_unauth_rce.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/161937/Advantech-iView-Unauthenticated-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-22652 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22652 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-040-02 · Note