CVE-2021-22652

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
n/a	Advantech iView	iView versions prior to v5.7.03.6112

References

http://packetstormsecurity.com/files/161937/Advantech-iView-Unauthenticated-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://us-cert.cisa.gov/ics/advisories/icsa-21-040-02Third Party Advisory, US Government Resource
http://packetstormsecurity.com/files/161937/Advantech-iView-Unauthenticated-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://us-cert.cisa.gov/ics/advisories/icsa-21-040-02Third Party Advisory, US Government Resource

Timeline

Published: Feb 11, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-226537.8Multiple out-of-bounds write issues have been identified in the way the application processes project files, allowing an attacker to craft a CVE-2021-226547.5Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose infor CVE-2021-226557.8Multiple out-of-bounds read issues have been identified in the way the application processes project files, allowing an attacker to craft a CVE-2021-226567.5Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files.CVE-2021-226579.8mySCADA myPRO: Versions 8.20.0 and prior has a feature where the API password can be specified, which may allow an attacker to inject arbitr CVE-2021-226589.8Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Adm CVE-2021-226598.6Rockwell Automation MicroLogix 1400 Version 21.6 and below may allow a remote unauthenticated attacker to send a specially crafted Modbus pa CVE-2021-22666.0Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is Prio CVE-2021-226607.8CNCSoft-B Versions 1.0.0.3 and prior is vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code.CVE-2021-226617.5Changing the password on the module webpage does not require the user to type in the current password first. Thus, the password could be cha CVE-2021-226627.8A use after free issue has been identified in Fatek FvDesigner Version 1.5.76 and prior in the way the application processes project files, CVE-2021-226637.8Cscape (All versions prior to 9.90 SP3.5) lacks proper validation of user-supplied data when parsing project files. This could lead to an ou