CVE-2021-21802

published 2021-07-16

CVE-2021-21802: This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an…

Priority P3 47 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

EXPLOIT

This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. A specially crafted URL by an attacker and visited by a victim can lead to arbitrary JavaScript code execution.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
advantech	r-seenet	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /php/device_graph_page.php?device_id=%22zlo%20onerror=alert(1)%20%22↗

path /php/device_graph_page.php↗

• → Look for GET requests to device_graph_page.php with a malicious device_id parameter containing injected HTML/JS event handlers (e.g., onerror=alert) ↗
• → Use Shodan query 'http.html:"r-seenet"' or FOFA query 'body="r-seenet"' to identify exposed Advantech R-SeeNet instances
• → The vulnerable parameter is device_id in the device_graph_page.php script; any unsanitized input reflected in the HTML body indicates exploitability

• · Vulnerability affects Advantech R-SeeNet version 2.4.12 specifically; verify CPE before applying detections
• · Exploitation requires user interaction (victim must visit the crafted URL); this is a reflected XSS, not stored ↗

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvd v3.0 9.6 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

nvd v2.0 4.3 MEDIUM AV:N/AC:M/Au:N/C:N/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79