CVE-2021-21799

Advantech R-SeeNet 2.4.12 is affected by a reflected XSS in telnet_form.php. The issue arises from improper input handling in telnet_form.php, enabling arbitrary script execution in the victim’s browser when a crafted URL is visited. Nuclei templates describe the vulnerability as a reflected XSS;...

CVE-2021-21805

CVE-2021-21805 affects Advantech R-SeeNet v2.4.12. The ping.php script is vulnerable to remote OS command injection via specially crafted HTTP requests, enabling arbitrary commands execution without credentials. The Nuclei template and Red Hat/other feeds corroborate remote execution risk; report...

CVE-2021-21801

CVE-2021-21801 affects Advantech R-SeeNet and targets the device_graph_page.php script, specifically the graph parameter. The NVD/Nuclei/Talos sources describe a cross-site scripting vulnerability that can lead to arbitrary JavaScript execution in the victim’s browser when a user visits a crafted...

CVE-2021-21803

Advantech R‑SeeNet’s device_graph_page.php has multiple reflected XSS vulnerabilities (CVE-2021-21803) via parameters such as is2sim, graph, and device_id. Exploitation can execute arbitrary JavaScript in the victim’s browser, even without authentication. Affected version noted in sources around ...

CVE-2021-21800

CVE-2021-21800 affects Advantech R-SeeNet 2.4.12 (ssh_form.php). It is a reflected cross-site scripting vulnerability that allows arbitrary JavaScript execution in the context of the targeted user’s browser when visiting a crafted URL. Documented impact includes potential exposure of administrato...

CVE-2021-21802

Advantech R-SeeNet is affected by CVE-2021-21802 in the device_graph_page.php script. The vulnerability is a cross-site scripting (XSS) issue triggered when attacker-controlled input (graph, device_id, is2sim) is unsafely embedded in HTML output, enabling arbitrary JavaScript execution in the vic...

CVE-2021-21937

CVE-2021-21937 affects Advantech R-SeeNet (industrial monitoring software) with multiple SQL injection flaws on the device_list page (notably in host_alt_filter and related filters). Root cause: improper neutralization of user-supplied data leading to SQL injection (CWE-89). Exploitation requires...

CVE-2021-21927

CVE-2021-21927 (plus related CVEs 21928–21937) affects Advantech R-SeeNet. Talos reports multiple SQL injection vulnerabilities in the device_list page (parameters including host_filter, health_filter, loc_filter, prod_filter, sn_filter, mac_filter, name_filter, esn_filter, imei_filter, imei, hos...

CVE-2020-25157

Summary of CVE-2020-25157 : The vulnerability affects Advantech’s R-SeeNet web application (versions 1.5.1 through 2.4.10). A flaw in device_position.php allows improper validation of the device_id parameter, enabling SQL injection that can disclose sensitive information from the R-SeeNet databas...

CVE-2022-3387

Advantech R-SeeNet (software management platform) Versions 2.4.19 and earlier are affected by CVE-2022-3387 due to an improper restriction of a pathname (path traversal). An unauthorized, remote attacker could exploit vulnerable PHP code to delete arbitrary .PDF files. The issue is documented wit...

CVE-2021-21934

CVE-2021-21934 affects Advantech R-SeeNet (industrial monitoring software). The issue arises from SQL injection vulnerabilities in the device_list page, exploitable through multiple filter parameters (notably imei_filter) due to improper handling of user-supplied input, enabling authenticated use...

CVE-2022-3386

CVE-2022-3386 affects Advantech R-SeeNet; versions 2.4.17 and earlier are vulnerable to a stack-based buffer overflow triggered by an outsized filename, enabling remote code execution. Exploitation is possible remotely (no authentication required per ZDI advisory) with high impact (CVE-2022-3386,...

CVE-2021-21926

CVE-2021-21926 affects Advantech R-SeeNet. Talos documents multiple SQL injection flaws in the device_list page (e.g., health_filter, desc_filter, loc_filter, prod_filter, sn_filter, mac_filter, name_filter, esn_filter, imei_filter, host_alt_filter2, host_alt_filter, etc.) that can be triggered b...

CVE-2021-21933

Summary (CVE-2021-21933): The Advantech R-SeeNet application contains SQL injection vulnerabilities on the device_list page (multiple filters such as esn_filter, descr, host, etc.). An authenticated attacker can trigger injections via crafted HTTP requests (including CSRF). The exploits stem from...

CVE-2022-3385

CVE-2022-3385 affects Advantech R-SeeNet, specifically versions 2.4.17 and prior. The vulnerability is a stack-based buffer overflow that an unauthenticated, remotely located attacker could exploit over the network to achieve remote code execution. Impact is high (CVE-2022-3385 base 9.8). Mitigat...

CVE-2021-21923

Advantech R-SeeNet contains multiple SQL injection vulnerabilities in the user_list page (filters: username_filter, name_filter, surname_filter, company_filter) due to improper neutralization of inputs and dynamic SQL/concatenated queries. Exploitation can be triggered by authenticated requests o...

CVE-2021-21932

CVE-2021-21932 refers to multiple SQL injection vulnerabilities in Advantech R-SeeNet (device_list page) exposed by insufficient input sanitization on several filters, including name_filter. The TALOS advisory details exploitable SQL injection in the device_list page via crafted HTTP requests aut...

CVE-2021-21916

Advantech R-SeeNet 2.4.15 (and prior) contains SQL injection vulnerabilities on the group_list page, including the description_filter parameter. The TALOS advisory documents multiple SQLi flaws in group_list with authenticated user or CSRF-enabled attack paths, and provides concrete proof-of-conc...

CVE-2023-3256

Summary: CVE-2023-3256 affects Advantech R-SeeNet (version 2.4.22 and earlier). The issue is described as external control of a file name or path, enabling a low-privilege user to access and load local files. The root cause is insufficient validation of user-supplied data before it is used in a P...

CVE-2021-21912

Advantech R-SeeNet for Windows (Version 2.4.15) has a privilege escalation vulnerability (CVE-2021-21912) allowing an authenticated user to replace specific executable files in C:\R-SeeNet and related services to gain NT SYSTEM privileges. The TALOS report details multiple components (mysqld.exe,...

CVE-2021-21917

CVE-2021-21917 highlights multiple SQL injection vulnerabilities in Advantech R-SeeNet, specifically in the group_list page of version 2.4.15 (and prior). The root cause is improper neutralization/handling of user-supplied input in several parameters used to build SQL queries (ord, company_filter...

CVE-2021-21918

CVE-2021-21918 affects Advantech R-SeeNet 2.4.15 where the name_filter parameter on the company_list page can be exploited to trigger SQL injection via a crafted authenticated HTTP request. The root cause is improper input handling in building SQL for the stored procedure call sp_GetCompanies, wi...

CVE-2021-21925

CVE-2021-21925 affects Advantech R-SeeNet (industrial monitoring software). The vulnerability is an SQL injection on the device_list page, exploitable by authenticated users (including via CSRF) through parameters such as firm_filter, desc_filter, and others that feed into SQL queries. The provid...

CVE-2021-21910

CVE-2021-21910 affects Advantech R-SeeNet on Windows (2.4.15). The vulnerability arises from improper default permissions allowing an authenticated user to replace certain executables (e.g., mysql service, SnmpMonSvs, Apache2.2) in C:\R-SeeNet and trigger privilege escalation to NT SYSTEM when th...

CVE-2021-21924

CVE-2021-21924 maps to multiple SQL injection vulnerabilities in Advantech R-SeeNet (monitoring software). Public details describe exploitable flaws in the device_list queries where a session-based desc_filter and other filters (host, health, loc, prod, sn, mac, name, esn, imei, etc.) are concate...

CVE-2023-5642

Advantech R-SeeNet v2.4.23 is affected by CVE-2023-5642. An unauthenticated remote attacker can read from and write to the snmpmon.ini file, which contains sensitive information, enabling information disclosure and potential further compromise. CVSS v3.1 metrics from NVD/Vuln reports indicate CRI...

CVE-2021-21804

Advantech R-SeeNet v2.4.12 contains a local file inclusion (LFI) in options.php where unsanitized user input ($sub_opt) is passed to include, enabling arbitrary PHP code execution. The TALOS writeup confirms an exploitable path via crafted HTTP requests (example uses php://filter to read config.i...

CVE-2021-21919

Advantech R-SeeNet contains multiple SQL injection flaws in the web app (notably on the company_list page), caused by improper neutralization of SQL input and dynamic query construction. Exploitation requires an authenticated user with elevated privileges (super-administrator), per TALOS-2021-136...

CVE-2023-2611

CVE-2023-2611 affects Advantech R-SeeNet version 2.4.22 and earlier, describing a hidden root-level user with an unchangeable password (hard-coded credentials) that authenticates remotely. Several connected sources confirm the root cause: a hidden user not exposed in the standard user list with a...

CVE-2021-21915

Advantech R-SeeNet (2.4.15, affected) contains SQL injection vulnerabilities in the group_list flow, notably via the company_filter parameter (and related filters like description_filter, ord). The issues arise from improper handling of user-supplied session-based filters that are used to assembl...

CVE-2021-21928

CVE-2021-21928 affects Advantech R-SeeNet (2.4.x and prior) with multiple SQL injection flaws in the web UI (e.g., device_list.php: mac_filter, desc_filter, loc_filter, prod_filter, sn_filter, etc.). An authenticated user or CSRF can trigger crafted HTTP requests to inject SQL via interpolated qu...

CVE-2021-21929

CVE-2021-21929 affects Advantech R-SeeNet. Multiple SQL injection vulnerabilities exist in the device_list page via numerous filters (e.g., prod_filter), due to how user/session inputs are incorporated into dynamic SQL. Exploitation can be performed by authenticated users (and may be CSRF-enabled...

CVE-2021-21936

CVE-2021-21936 describes multiple SQL injection vulnerabilities in Advantech R-SeeNet driven by insecure SQL construction in device_list.php. The issues arise from using session-scoped filters (e.g., health_filter, desc_filter, loc_filter, prod_filter, sn_filter, mac_filter, name_filter, imei_fil...

CVE-2021-21911

Advantech R-SeeNet on Windows is affected by CVE-2021-21911 (Privilege escalation via SnmpMonSvs service executable) affecting 2.4.15. The vulnerability is caused by insufficient protection of the C:\R-SeeNet installation files, allowing an authenticated user to replace the SnmpMonSvs service bin...

CVE-2021-21931

CVE-2021-21931 affects Advantech R-SeeNet web interface. Multiple SQL injection paths exist in device_list.php (notably via stat_filter and related filters like host/prod/desc/etc.), allowing authenticated users (or CSRF-tied actions) to inject SQL through crafted HTTP requests. TALOS and related...

CVE-2021-21922

CVE-2021-21922 affects Advantech R-SeeNet (2.4.15 and prior) via SQL injection in the user_list page, caused by improper neutralization of inputs in several filters (username_filter, name_filter, surname_filter, company_filter). An authenticated user (or via CSRF) can inject SQL through these par...

CVE-2021-21930

CVE-2021-21930 affects Advantech R-SeeNet 2.4.15 (and related entries) with multiple SQL injection vulnerabilities in the device_list page, including filters such as sn_filter, prod_filter, mac_filter, host_filter, name_filter, esn_filter, imei_filter and others. The root cause is improper neutra...

CVE-2021-21920

CVE-2021-21920 affects Advantech R-SeeNet (2.4.15 and earlier) via the SQL injection on the user_list page, caused by improper handling of the surname_filter parameter. The vulnerability builds a dynamic SQL query by concatenating user-controlled input into the query, and it can be triggered by a...

CVE-2021-21935

CVE-2021-21935 maps to multiple SQL-injection vulnerabilities in Advantech R-SeeNet (device_list and related filters). Root cause is improper input handling (dynamic SQL via various filter parameters such as host_alt_filter2, desc_filter, prod_filter, etc.), allowing authenticated users (or CSRF ...

CVE-2021-21921

CVE-2021-21921 affects Advantech R-SeeNet (2.4.15 era) with SQL injection in the name_filter parameter of the user_list page. The root cause is improper neutralization/concatenation of SQL, enabling authenticated users (and CSRF) to inject SQL via the name_filter input. Talos reports multiple SQL...