Advisory Details

February 11th, 2021

Advantech iView NetworkServlet ztp_config_name SQL Injection Information Disclosure Vulnerability

CVE ID	CVE-2021-22654
CVSS SCORE	7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AFFECTED VENDORS	Advantech
AFFECTED PRODUCTS	iView
VULNERABILITY DETAILS	This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetworkServlet class. When parsing the ztp_config_name parameter, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise.
ADDITIONAL DETAILS	Advantech has issued an update to correct this vulnerability. More details can be found at: https://us-cert.cisa.gov/ics/advisories/icsa-21-040-02
DISCLOSURE TIMELINE	2020-12-02 - Vulnerability reported to vendor 2021-02-11 - Coordinated public release of advisory
CREDIT	rgod

BACK TO ADVISORIES