Vulnerability Spotlight: Multiple vulnerabilities in Advantech R-See Net

Summary: Cisco Talos discovered multiple vulnerabilities in Advantech R-SeeNet, the monitoring software for Advantech routers, including SQL injection flaws in various web application scripts tracked as TALOS-2021-1366, TALOS-2021-1365, TALOS-2021-1363 and TALOS-2021-1364. A separate privilege escalation vulnerability, TALOS-2021-1360, exists only in the Windows version and lets an attacker place a specially-crafted file on the system to escalate to NT SYSTEM authority. Talos confirmed version 2.4.15 (30.07.2021) could be exploited and worked with Advantech on an update.
Bottom line: The privilege escalation path ends at NT SYSTEM, the highest authority on a Windows host, and the SQL injection flaws sit in the web pages of software whose job is to collect data from every router in the network.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-21910 CVE-2021-21911 CVE-2021-21912 CVE-2021-21915 CVE-2021-21916 CVE-2021-21917 CVE-2021-21918 CVE-2021-21919 CVE-2021-21920 CVE-2021-21921 CVE-2021-21922 CVE-2021-21923
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026