CVE-2021-22652 Missing authorization in Advantech iView

Critical 9.8 Published 11 Feb 2021 Updated 3 Aug 2024

Unauthorized attackers can modify configuration and execute code in Advantech iView due to missing authentication.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-22652?

CVE-2021-22652 is a critical missing authorization vulnerability in Advantech iView, published on 11 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution.

Weakness: CWE-306

Which versions are affected by CVE-2021-22652?

It affects 1 product.

Products include Advantech Iview.

How do I fix CVE-2021-22652?

No fix has been published for CVE-2021-22652 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2021-22652 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-22652 exists.

Public exploit code: 1 Metasploit module.

Sources

Also known as GHSA-23jg-2v84-hg56.