PT-2021-3932 · Advantech · Advantech R-Seenet

Published 2021-07-15 · Updated 2022-09-30 · CVE-2021-21799

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet version 2.4.12

Description The issue exists in the telnet form.php script functionality, allowing for cross-site scripting vulnerabilities. If a user visits a specially crafted URL, it can lead to arbitrary JavaScript code execution in the context of the targeted user’s browser. An attacker can provide a crafted URL to trigger this vulnerability, potentially allowing for remote execution of arbitrary code.

Recommendations For Advantech R-SeeNet version 2.4.12, consider disabling the telnet form.php script functionality until a patch is available to prevent exploitation. Restrict access to the telnet form.php script to minimize the risk of arbitrary JavaScript code execution. Avoid using crafted URLs that could trigger this issue until the vulnerability is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-04449

CVE-2021-21799

Affected Products

Advantech R-Seenet

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1270 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-21799 · Security Note
• https://bdu.fstec.ru/vul/2021-04449 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21799 · Vendor Advisory
• https://t.me/cvenotify/18175 · Telegram Post
• https://t.me/cvenotify/36963 · Telegram Post