PT-2021-15152 · Advantech · Iview

Rgod · Published 2021-02-11 · Updated 2021-02-12 · CVE-2021-22654

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advantech iView versions prior to 5.7.03.6112

Description The issue allows an unauthorized attacker to disclose information through SQL injection. It affects the NetworkServlet and UserServlet, potentially allowing information disclosure.

Recommendations For versions prior to 5.7.03.6112, update to version 5.7.03.6112 or later to resolve the issue. As a temporary workaround, consider restricting access to the NetworkServlet and UserServlet to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-22654

ZDI-21-188

ZDI-21-190

Affected Products

Iview

References · 5

• https://zerodayinitiative.com/advisories/ZDI-21-188 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22654 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-21-190 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22654 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsa-21-040-02 · Note