PT-2021-5481 · Advantech · Advantech R-Seenet

Yuri Kramarz · Published 2021-08-19 · Updated 2022-05-13 · CVE-2021-21916

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet version 2.4.15

Description An exploitable SQL injection vulnerability exists in the 'group list' page. A specially-crafted HTTP request at the description filter parameter can trigger this issue. An attacker can make authenticated HTTP requests to exploit this vulnerability, which can be done as any authenticated user or through cross-site request forgery. The vulnerability is related to the lack of protection of the SQL query structure, allowing a remote attacker to execute arbitrary SQL queries.

Recommendations For Advantech R-SeeNet version 2.4.15, consider disabling access to the 'group list' page or restricting the use of the description filter parameter until a patch is available. Additionally, restrict access to authenticated HTTP requests to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2021-06328

CVE-2021-21916

Affected Products

Advantech R-Seenet

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1363 · Exploit
• https://bdu.fstec.ru/vul/2021-06328 · Security Note
• https://safe-surf.ru/upload/VULN/VULN-20211124.3.pdf · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21916 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21916 · Vendor Advisory
• https://t.me/cibsecurity/34536 · Telegram Post