PT-2021-5496 · Advantech · Advantech R-Seenet

Yuri Kramarz · Published 2021-08-19 · Updated 2022-05-13 · CVE-2021-21915

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech R-SeeNet version 2.4.15

Description The issue is related to a lack of protection against SQL injection attacks in the company filter parameter of the group list page. This can be exploited by sending specially crafted SQL queries, potentially allowing remote attackers to conduct cross-site scripting attacks. An attacker can trigger this issue by making authenticated HTTP requests.

Recommendations For Advantech R-SeeNet version 2.4.15, consider restricting access to the group list page until a patch is available. As a temporary workaround, avoid using the company filter parameter in the affected page to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2021-06346

CVE-2021-21915

Affected Products

Advantech R-Seenet

References · 6

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2021-1363 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-21915 · Security Note
• https://safe-surf.ru/upload/VULN/VULN-20211124.3.pdf · Security Note
• https://bdu.fstec.ru/vul/2021-06346 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21915 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2021112314 · Note