PT-2021-5480 · Advantech · Advantech R-Seenet

Yuri Kramarz · Published 2021-08-19 · Updated 2022-07-22 · CVE-2021-21923

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet (affected versions not specified)

Description The issue is related to a SQL injection vulnerability. It can be triggered by making authenticated HTTP requests to the company filter parameter, potentially through cross-site request forgery or using an administrative account. The vulnerability is associated with a lack of protection for the SQL query structure in the user list component. An attacker can exploit this vulnerability to execute arbitrary SQL queries.

Recommendations For Advantech R-SeeNet, consider disabling access to the company filter parameter in the user list component until a patch is available. Restrict access to the administrative account to minimize the risk of exploitation. Avoid using the company filter parameter in affected HTTP requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2021-06327

CVE-2021-21923

Affected Products

Advantech R-Seenet

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1365 · Exploit
• https://bdu.fstec.ru/vul/2021-06327 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21923 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21923 · Vendor Advisory
• https://safe-surf.ru/upload/VULN/VULN-20211124.3.pdf · Security Note
• https://talosintelligence.com/vulnerability_reports/TALOS-2021-1365icsa-21-348-01 · Note