Experts disclose critical flaws in Advantech router monitoring tool

Cisco Talos experts disclose details of several critical flaws in a router monitoring application developed by industrial and IoT firm Advantech.

Cisco Talos researchers discovered multiple critical vulnerabilities in the R-SeeNet application developed by industrial and IoT firm Advantech. The application allows network administrators to monitor Advantech routers in their infrastructure.

The monitoring tool collects information from routers in the network and stores it into a SQL database. The flaws discovered by Talos reside in several scripts inside of R-SeeNet’s web applications. 

An attacker could exploit the flaws execute arbitrary JavaScript code in the targeted user’s browser, execute arbitrary OS commands, and execute PHP commands.

“TALOS-2021-1270 (CVE-2021-21799), TALOS-2021-1271 (CVE-2021-21800) and TALOS-2021-1272 (CVE-2021-21801 – CVE-2021-21803) are all vulnerabilities that could allow an attacker to execute arbitrary JavaScript code in the context of the targeted user’s browser. An adversary could exploit any of these vulnerabilities by sending the target a malicious URL and tricking the user into opening it.Another command execution vulnerability, TALOS-2021-1274 (CVE-2021-21805), could allow an adversary to execute OS commands by sending the targeted device a specially crafted HTTP request.” reads the advisory published by Talos researchers.

“There is also a file inclusion vulnerability that could allow an attacker to execute arbitrary PHP commands. TALOS-2021-1273 (CVE-2021-21804) exists in R-SeeNet’s options.php script functionality and could be triggered via a malicious HTTP request.”

The flaws affect R-SeeNet version 2.4.12 and Talos team reported them to Advantech in March.

The experts decided to publicly disclose the vulnerabilities after Advantech failed to address them within the 90-day deadline, they also published proof-of-concept (PoC) exploits for the issues.

Cisco Talos also released SNORT rules 57290 – 57293, 57305 – 57309, 57338 and 57339, to detect exploitation attempts against the above flaws

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Advantech)

---