CVE-2021-21926

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘healthfilter’ parameter...

CVE-2021-21927

CVE-2021-21927 (plus related CVEs 21928–21937) affects Advantech R-SeeNet. Talos reports multiple SQL injection vulnerabilities in the device_list page (parameters including host_filter, health_filter, loc_filter, prod_filter, sn_filter, mac_filter, name_filter, esn_filter, imei_filter, imei, hos...

CVE-2021-21926

CVE-2021-21926 affects Advantech R-SeeNet. Talos documents multiple SQL injection flaws in the device_list page (e.g., health_filter, desc_filter, loc_filter, prod_filter, sn_filter, mac_filter, name_filter, esn_filter, imei_filter, host_alt_filter2, host_alt_filter, etc.) that can be triggered b...

CVE-2021-21927

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘locfilter’ parameter...

CVE-2021-21925

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘firmfilter’ parameter...

CVE-2021-21925

CVE-2021-21925 affects Advantech R-SeeNet (industrial monitoring software). The vulnerability is an SQL injection on the device_list page, exploitable by authenticated users (including via CSRF) through parameters such as firm_filter, desc_filter, and others that feed into SQL queries. The provid...

CVE-2021-21924

CVE-2021-21924 maps to multiple SQL injection vulnerabilities in Advantech R-SeeNet (monitoring software). Public details describe exploitable flaws in the device_list queries where a session-based desc_filter and other filters (host, health, loc, prod, sn, mac, name, esn, imei, etc.) are concate...

CVE-2021-21924

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger these vulnerabilities. This can be done as any authenticated user or through cross-site request forgery at ‘descfilter’ parameter...

CVE-2021-21923

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘companyfilter’ parameter with the administrative account or through cross-site request forgery...

CVE-2021-21923

Advantech R-SeeNet contains multiple SQL injection vulnerabilities in the user_list page (filters: username_filter, name_filter, surname_filter, company_filter) due to improper neutralization of inputs and dynamic SQL/concatenated queries. Exploitation can be triggered by authenticated requests o...

CVE-2021-21922

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘usernamefilter’ parameter with the administrative account or through cross-site request forgery...

CVE-2021-21922

CVE-2021-21922 affects Advantech R-SeeNet (2.4.15 and prior) via SQL injection in the user_list page, caused by improper neutralization of inputs in several filters (username_filter, name_filter, surname_filter, company_filter). An authenticated user (or via CSRF) can inject SQL through these par...

CVE-2021-21921

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘namefilter’ parameter with the administrative account or through cross-site request forgery...

CVE-2021-21920

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘surnamefilter’ parameter with the administrative account or through cross-site request forgery...

CVE-2021-21920

CVE-2021-21920 affects Advantech R-SeeNet (2.4.15 and earlier) via the SQL injection on the user_list page, caused by improper handling of the surname_filter parameter. The vulnerability builds a dynamic SQL query by concatenating user-controlled input into the query, and it can be triggered by a...

CVE-2021-21921

CVE-2021-21921 affects Advantech R-SeeNet (2.4.15 era) with SQL injection in the name_filter parameter of the user_list page. The root cause is improper neutralization/concatenation of SQL, enabling authenticated users (and CSRF) to inject SQL via the name_filter input. Talos reports multiple SQL...

CVE-2021-21919

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ord’ parameter. However, the high privilege super-administrator account needs to be used to achieve exploitation without cross-site request forgery attack...

CVE-2021-21919

Advantech R-SeeNet contains multiple SQL injection flaws in the web app (notably on the company_list page), caused by improper neutralization of SQL input and dynamic query construction. Exploitation requires an authenticated user with elevated privileges (super-administrator), per TALOS-2021-136...

CVE-2021-21918

CVE-2021-21918 affects Advantech R-SeeNet 2.4.15 where the name_filter parameter on the company_list page can be exploited to trigger SQL injection via a crafted authenticated HTTP request. The root cause is improper input handling in building SQL for the stored procedure call sp_GetCompanies, wi...

CVE-2021-21918

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘namefilter’ parameter. However, the high privilege super-administrator account needs to be used to achieve exploitation without cross-site request forgery...