Sign-up

ID

VAR-202108-0483


CVE

CVE-2021-21805


TITLE

Advantech R-SeeNet  In  OS  Command injection vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2021-009475

DESCRIPTION

An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary OS command execution. An attacker can send a crafted HTTP request to trigger this vulnerability. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Advantech R-SeeNet is an industrial monitoring software developed by China Taiwan Advantech Company. The software monitors the platform based on the snmp protocol, and is suitable for Linux and Windows platforms

Trust: 2.34

sources: NVD: CVE-2021-21805 // JVNDB: JVNDB-2021-009475 // CNNVD: CNNVD-202104-975 // VULHUB: VHN-380209 // VULMON: CVE-2021-21805

AFFECTED PRODUCTS

vendor:advantechmodel:r-seenetscope:eqversion:2.4.12

Trust: 1.0

vendor:アドバンテック株式会社model:r-seenetscope:eqversion: -

Trust: 0.8

vendor:アドバンテック株式会社model:r-seenetscope:eqversion:2.4.12 (20.10.2020)

Trust: 0.8

sources: JVNDB: JVNDB-2021-009475 // NVD: CVE-2021-21805

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2021-21805
value: CRITICAL

Trust: 1.0

talos-cna@cisco.com: CVE-2021-21805
value: CRITICAL

Trust: 1.0

NVD: CVE-2021-21805
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-202104-975
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202107-1114
value: CRITICAL

Trust: 0.6

VULHUB: VHN-380209
value: HIGH

Trust: 0.1

VULMON: CVE-2021-21805
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2021-21805
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-380209
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

talos-cna@cisco.com: CVE-2021-21805
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

nvd@nist.gov: CVE-2021-21805
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-380209 // VULMON: CVE-2021-21805 // JVNDB: JVNDB-2021-009475 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202107-1114 // NVD: CVE-2021-21805 // NVD: CVE-2021-21805

PROBLEMTYPE DATA

problemtype:CWE-78

Trust: 1.1

problemtype:OS Command injection (CWE-78) [NVD Evaluation ]

Trust: 0.8

sources: VULHUB: VHN-380209 // JVNDB: JVNDB-2021-009475 // NVD: CVE-2021-21805

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202107-1114

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-202104-975

PATCH

title:Top Pageurl:https://icr.advantech.cz/

Trust: 0.8

title:Kenzer Templates [5170] [DEPRECATED]url:https://github.com/ARPSyndicate/kenzer-templates

Trust: 0.1

sources: VULMON: CVE-2021-21805 // JVNDB: JVNDB-2021-009475

EXTERNAL IDS

db:NVDid:CVE-2021-21805

Trust: 3.4

db:TALOSid:TALOS-2021-1274

Trust: 2.6

db:JVNDBid:JVNDB-2021-009475

Trust: 0.8

db:CNNVDid:CNNVD-202107-1114

Trust: 0.7

db:CS-HELPid:SB2021041363

Trust: 0.6

db:CNNVDid:CNNVD-202104-975

Trust: 0.6

db:CS-HELPid:SB2021071609

Trust: 0.6

db:VULHUBid:VHN-380209

Trust: 0.1

db:VULMONid:CVE-2021-21805

Trust: 0.1

sources: VULHUB: VHN-380209 // VULMON: CVE-2021-21805 // JVNDB: JVNDB-2021-009475 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202107-1114 // NVD: CVE-2021-21805

REFERENCES

url:https://talosintelligence.com/vulnerability_reports/talos-2021-1274

Trust: 3.2

url:https://nvd.nist.gov/vuln/detail/cve-2021-21805

Trust: 0.8

url:https://www.cybersecurity-help.cz/vdb/sb2021041363

Trust: 0.6

url:https://www.cybersecurity-help.cz/vdb/sb2021071609

Trust: 0.6

url:https://cwe.mitre.org/data/definitions/78.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://github.com/arpsyndicate/kenzer-templates

Trust: 0.1

sources: VULHUB: VHN-380209 // VULMON: CVE-2021-21805 // JVNDB: JVNDB-2021-009475 // CNNVD: CNNVD-202104-975 // CNNVD: CNNVD-202107-1114 // NVD: CVE-2021-21805

CREDITS

Member of the Cisco Talos team

Trust: 0.6

sources: CNNVD: CNNVD-202107-1114

SOURCES

db:VULHUBid:VHN-380209
db:VULMONid:CVE-2021-21805
db:JVNDBid:JVNDB-2021-009475
db:CNNVDid:CNNVD-202104-975
db:CNNVDid:CNNVD-202107-1114
db:NVDid:CVE-2021-21805

LAST UPDATE DATE

2024-08-14T12:46:45.841000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-380209date:2022-09-30T00:00:00
db:VULMONid:CVE-2021-21805date:2022-09-30T00:00:00
db:JVNDBid:JVNDB-2021-009475date:2022-04-28T03:46:00
db:CNNVDid:CNNVD-202104-975date:2021-04-14T00:00:00
db:CNNVDid:CNNVD-202107-1114date:2021-08-13T00:00:00
db:NVDid:CVE-2021-21805date:2022-09-30T03:09:26.817

SOURCES RELEASE DATE

db:VULHUBid:VHN-380209date:2021-08-05T00:00:00
db:VULMONid:CVE-2021-21805date:2021-08-05T00:00:00
db:JVNDBid:JVNDB-2021-009475date:2022-04-28T00:00:00
db:CNNVDid:CNNVD-202104-975date:2021-04-13T00:00:00
db:CNNVDid:CNNVD-202107-1114date:2021-07-15T00:00:00
db:NVDid:CVE-2021-21805date:2021-08-05T21:15:10.683