PT-2021-5489 · Advantech · Advantech R-Seenet

Yuri Kramarz · Published 2021-08-19 · Updated 2022-07-23 · CVE-2021-21918

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet (affected versions not specified)

Description A specially-crafted HTTP request can lead to SQL injection, allowing an attacker to execute arbitrary SQL queries. This can be triggered by making authenticated HTTP requests, specifically targeting the name filter parameter. Exploitation without a cross-site request forgery attack requires the use of a high-privilege super-administrator account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2021-06338

CVE-2021-21918

Affected Products

Advantech R-Seenet

References · 7

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1364 · Exploit
• https://osv.dev/vulnerability/CVE-2021-21918 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21918 · Security Note
• https://safe-surf.ru/upload/VULN/VULN-20211124.3.pdf · Security Note
• https://bdu.fstec.ru/vul/2021-06338 · Security Note
• https://cybersecurity-help.cz/vdb/SB2021112314 · Note
• https://t.me/cvenotify/33673 · Telegram Post