CVE-2021-21805 Command injection in Advantech

What is CVE-2021-21805?

CVE-2021-21805 is a critical command injection vulnerability in Advantech, published on 5 Aug 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary OS command execution. An attacker can send a crafted HTTP request to trigger this vulnerability.

Weakness: CWE-78

Which versions are affected by CVE-2021-21805?

It affects 1 product.

Products include Advantech R-Seenet.

How do I fix CVE-2021-21805?

No fix has been published for CVE-2021-21805 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2021-21805 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-21805 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Advantech

• CVE-2023-5642 Advantech R-SeeNet Unauthenticated Read/Write Critical 9.8
• CVE-2023-2611 Advantech R-SeeNet Use of Hard-coded Credentials Critical 9.8
• CVE-2022-3385 Memory corruption in R-SeeNet Critical 9.8
• CVE-2022-3386 Memory corruption in R-SeeNet Critical 9.8
• CVE-2021-21799 Cross-site scripting in Advantech Critical 9.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-r4xf-pp9q-gmx5.