Advantech R-SeeNet
Advantech is aware of multiple SQL injection vulnerabilities in the following pages: group_list, company_list, user_list, and device_list. An attacker could send a specially crafted HTTP request to trigger the vulnerabilities.CVE-2021-21915, CVE-2021-21916, CVE-2021-21917, CVE-2021-21918, CVE-2021-21919, CVE-2021-21920, CVE-2021-21921, CVE-2021-21922, CVE-2021-21923, CVE-2021-21924, CVE-2021-21925, CVE-2021-21926, CVE-2021-21927, CVE-2021-21928, CVE-2021-21929, CVE-2021-21930, CVE-2021-21931, CVE-2021-21932, CVE-2021-21933, CVE-2021-21934, CVE-2021-21935, CVE-2021-21936, and CVE-2021-21937 have been assigned to these vulnerabilities. A CVSS v3 base score of 7.7 has been assigned; the CVSS vector string is (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Advantech is aware of multiple privilege escalation vulnerabilities that could be triggered when an authenticated user replaces a specially crafted file in the system to escalate privileges to NT SYSTEM authority.CVE-2021-21910, CVE-2021-21911, and CVE-2021-21912 have been assigned to these vulnerabilities. A CVSS v3 base score of 8.8 has been assigned; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).