CVE-2021-21804: advantech r-seenet PHP Remote File Inclusion

Vulnerability summary

CVE-2021-21804 is a critical (CVSS 9.8) PHP Remote File Inclusion vulnerability in advantech r-seenet. EPSS estimates a 3.71% chance of exploitation in the next 30 days, higher than 89.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 16-07-2021
   PublishedVulnerability first disclosed.
2. 03-08-2024
   Last modifiedVulnerability information updated.

Description

A local file inclusion (LFI) vulnerability exists in the options.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). A specially crafted HTTP request can lead to arbitrary PHP code execution. An attacker can send a crafted HTTP request to trigger this vulnerability.

• CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
• CWE-829Inclusion of Functionality from Untrusted Control SphereThe product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.