Read the docs

Advantech

Records434All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical118CVSS 9.0–10.0
CVSS high195CVSS 7.0–8.9

Exploited now

Advantech records in CISA KEV

No Advantech vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Webaccess 103 records HIGH Advantech Webaccess 44 records HIGH R-seenet 40 records HIGH Iview 37 records HIGH Webaccess/scada 29 records MEDIUM Eki-6333ac-1gpo Firmware 20 records MEDIUM Eki-6333ac-2g Firmware 20 records MEDIUM Eki-6333ac-2gd Firmware 20 records MEDIUM

Records

40 records in R-seenet · all components

TI-2023-05193 CVE-2023-5642 · GHSA-4q58-qpcg-q4vf

Advantech R-SeeNet Unauthenticated Read/Write

Priority HIGH 82

Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitive information.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.18041 Published 2023-10-18 Fixed in 2.4.23 CWE-200
TI-2021-04850 CVE-2021-21805 · GHSA-r4xf-pp9q-gmx5

OS command injection in Advantech

Priority HIGH 79

An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.69631 Published 2021-08-05 No fix listed CWE-78
TI-2021-04846 CVE-2021-21801 · GHSA-v3m2-qvx7-g2wh

Cross-site scripting in Advantech

Priority MEDIUM 61

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.58968 Published 2021-07-16 No fix listed CWE-79
TI-2022-03130 CVE-2022-3386 · GHSA-phvc-rjr5-r475

Stack-based buffer overflow in Advantech R-SeeNet

Priority MEDIUM 52

Advantech R-SeeNet Versions 2.4.17 and prior are vulnerable to a stack-based buffer overflow.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01638 Published 2022-10-27 No fix listed CWE-121
TI-2022-03129 CVE-2022-3385 · GHSA-h4vx-4v48-w8jh

Stack-based buffer overflow in Advantech R-SeeNet

Priority MEDIUM 52

Advantech R-SeeNet Versions 2.4.17 and prior are vulnerable to a stack-based buffer overflow.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01638 Published 2022-10-27 No fix listed CWE-121
TI-2023-02441 CVE-2023-2611 · GHSA-86p5-h8pq-p6hx

Advantech R-SeeNet Use of Hard-coded Credentials

Priority MEDIUM 50

Advantech R-SeeNet versions 2.4.22 is installed with a hidden root-level user that is not available in the users list.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00668 Published 2023-06-22 No fix listed CWE-798
TI-2022-03131 CVE-2022-3387 · GHSA-3qhw-3jqv-hq24

Path traversal in Advantech R-SeeNet

Priority MEDIUM 50

Advantech R-SeeNet Versions 2.4.19 and prior are vulnerable to path traversal attacks.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.1398 Published 2022-10-27 No fix listed CWE-22
TI-2021-04969 CVE-2021-21924 · GHSA-xw93-h7ff-35ff

SQL injection in Advantech

Priority MEDIUM 48

A specially-crafted HTTP request can lead to SQL injection.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.20155 Published 2021-12-22 No fix listed CWE-89
TI-2021-04845 CVE-2021-21800 · GHSA-xhc7-qp6w-xmwm

Cross-site scripting in Advantech

Priority MEDIUM 42

Cross-site scripting vulnerabilities exist in the ssh_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.14115 Published 2021-07-16 No fix listed CWE-79
TI-2023-03051 CVE-2023-3256 · GHSA-79pm-5425-72gv

Advantech R-SeeNet External Control of File Name or Path

Priority MEDIUM 41

Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00783 Published 2023-06-22 No fix listed CWE-73
TI-2021-04981 CVE-2021-21936 · GHSA-3h88-qhgq-2p27

SQL injection in Advantech

Priority MEDIUM 41

A specially-crafted HTTP request can lead to SQL injection.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01425 Published 2021-12-22 No fix listed CWE-89
TI-2021-04962 CVE-2021-21917 · GHSA-ccjc-vc4q-6gm3

SQL injection in Advantech

Priority MEDIUM 41

An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01425 Published 2021-12-22 No fix listed CWE-89
TI-2021-04961 CVE-2021-21916 · GHSA-p5g4-23jm-f3jq

SQL injection in Advantech

Priority MEDIUM 41

An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01425 Published 2021-12-22 No fix listed CWE-89
TI-2021-04960 CVE-2021-21915 · GHSA-w84c-gxm3-wgvc

SQL injection in Advantech

Priority MEDIUM 41

An exploitable SQL injection vulnerability exist in the ‘group_list’ page of the Advantech R-SeeNet 2.4.15 (30.07.2021).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01425 Published 2021-12-22 No fix listed CWE-89
TI-2021-04844 CVE-2021-21799 · GHSA-4jqw-vm5q-2f6h

Cross-site scripting in Advantech

Priority MEDIUM 41

Cross-site scripting vulnerabilities exist in the telnet_form.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.12293 Published 2021-07-16 No fix listed CWE-79
TI-2021-04847 CVE-2021-21802 · GHSA-xwr5-mcxm-cm87

Cross-site scripting in Advantech

Priority MEDIUM 40

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.099 Published 2021-07-16 No fix listed CWE-79
TI-2021-04848 CVE-2021-21803 · GHSA-2fvw-6h8p-qwr7

Cross-site scripting in Advantech

Priority LOW 38

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.07902 Published 2021-07-16 No fix listed CWE-79
TI-2020-15399 CVE-2020-25157 · GHSA-hpcw-6mrq-7xg2

SQL injection in Advantech R-SeeNet

Priority LOW 36

The R-SeeNet webpage (1.5.1 through 2.4.10) suffers from SQL injection, which allows a remote attacker to invoke queries on the database and retrieve sensitive information.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01413 Published 2020-10-20 No fix listed CWE-89
TI-2021-04957 CVE-2021-21912 · GHSA-4m8w-whg9-q7f6

Incorrect default permissions in Advantech

Priority LOW 34

A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021).

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0039 Published 2021-12-22 No fix listed CWE-276
TI-2021-04956 CVE-2021-21911 · GHSA-2267-86vq-8f86

Incorrect default permissions in Advantech

Priority LOW 34

A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021).

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00324 Published 2021-12-22 No fix listed CWE-276
TI-2021-04955 CVE-2021-21910 · GHSA-46qw-g75p-jr7h

Incorrect default permissions in Advantech

Priority LOW 34

A privilege escalation vulnerability exists in the Windows version of installation for Advantech R-SeeNet Advantech R-SeeNet 2.4.15 (30.07.2021).

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00324 Published 2021-12-22 No fix listed CWE-276
TI-2021-04982 CVE-2021-21937 · GHSA-7r2g-h6w6-6w7r

SQL injection in Advantech

Priority LOW 31

A specially-crafted HTTP request can lead to SQL injection.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01215 Published 2021-12-22 No fix listed CWE-89
TI-2021-04980 CVE-2021-21935 · GHSA-fxcv-6wmm-v575

SQL injection in Advantech

Priority LOW 31

A specially-crafted HTTP request can lead to SQL injection.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01181 Published 2021-12-22 No fix listed CWE-89
TI-2021-04979 CVE-2021-21934 · GHSA-rv48-5j5c-5fwr

SQL injection in Advantech

Priority LOW 31

A specially-crafted HTTP request can lead to SQL injection.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01181 Published 2021-12-22 No fix listed CWE-89
Load more
Open these records in search →