CVE-2021-21805

2021-08-0520:03:59

CWE-78

talos

www.cve.org

os command injection

ping.php script

arbitrary execution

http request

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.967

Percentile

99.7%

JSON

An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary OS command execution. An attacker can send a crafted HTTP request to trigger this vulnerability.

CNA Affected

[
  {
    "product": "Advantech",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Advantech R-SeeNet 2.4.12 (20.10.2020)"
      }
    ]
  }
]