CVE-2021-21804 Code injection in Advantech

What is CVE-2021-21804?

CVE-2021-21804 is a high-severity code injection vulnerability in Advantech, published on 16 Jul 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary PHP code execution. An attacker can send a crafted HTTP request to trigger this vulnerability.

Weakness: CWE-829, CWE-98

Which versions are affected by CVE-2021-21804?

It affects 1 product.

Products include Advantech R-Seenet.

How do I fix CVE-2021-21804?

No fix has been published for CVE-2021-21804 yet. Limit exposure of the affected software until one is available.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2021-21804 being exploited?

There is no known exploitation of CVE-2021-21804 in the wild and no public exploit code.

Other vulnerabilities in Advantech

• CVE-2023-5642 Advantech R-SeeNet Unauthenticated Read/Write Critical 9.8
• CVE-2023-2611 Advantech R-SeeNet Use of Hard-coded Credentials Critical 9.8
• CVE-2022-3385 Memory corruption in R-SeeNet Critical 9.8
• CVE-2022-3386 Memory corruption in R-SeeNet Critical 9.8
• CVE-2021-21805 Command injection in Advantech Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6vrg-rvc9-7gxh.