CVE-2021-21802 | BDVDB-2026-157124 Detail

Advantech

Description#

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.

Impact#

Per CVSS v3.0: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.

Weaknesses#

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

References#

https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272

Exploit#

No public exploit known

History#

Version 12021-07-16Record published in the CVE List.
Version 22024-08-03Most recent update recorded in the CVE List.

Published

Published: 2021-07-16
Last modified: 2024-08-03

Vendor information

Vendor: Not stated
Product: Advantech

Score

9.6 Critical

EPSS

9.9%, Low

Estimated chance of exploitation in the next 30 days. EPSS percentile: 95.6.

KEV

Not listed in the CISA Known Exploited Vulnerabilities catalog.

Impact

Cross-Site Scripting

Action

No specific action is recorded in the source data. Check the references for vendor guidance.

Affected Systems

Vulnerable
Advantech R-SeeNet 2.4.12 (20.10.2020)
Fixed
Not stated

Scoring System

CVSS v4.0

Not available

CVSS v3.1

Not available

CVSS v3.0

9.6 Critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Metric breakdown
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	Required
Scope	Changed
Confidentiality	High
Integrity	High
Availability	High

CVSS v2

Not available

Source: CVE List v5 (record); CISA KEV (kev, action); FIRST EPSS (epss).