CVE-2021-27436

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

WebAccess/SCADA Versions 9.0 and prior is vulnerable to cross-site scripting, which may allow an attacker to send malicious JavaScript code to an unsuspecting user, which could result in hijacking of the user’s cookie/session tokens, redirecting the user to a malicious webpage and performing unintended browser actions.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	Advantech WebAccess/SCADA	Versions 9.0 and prior

References

https://us-cert.cisa.gov/ics/advisories/icsa-21-075-01Third Party Advisory, US Government Resource
https://us-cert.cisa.gov/ics/advisories/icsa-21-075-01Third Party Advisory, US Government Resource

Timeline

Published: Mar 18, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-274379.1The affected product allows attackers to obtain sensitive information from the WISE-PaaS dashboard. The system contains a hard-coded adminis CVE-2021-274388.8The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components CVE-2021-274399.8TencentOS-tiny version 3.1.0 is vulnerable to integer wrap-around in function 'tos_mmheap_alloc incorrect calculation of effective memory al CVE-2021-274409.8The software contains a hard-coded password it uses for its own inbound authentication or for outbound communication to external components CVE-2021-274426.1The Weintek cMT product line is vulnerable to a cross-site scripting vulnerability, which could allow an unauthenticated remote attacker to CVE-2021-274449.8The Weintek cMT product line is vulnerable to various improper access controls, which may allow an unauthenticated attacker to remotely acce CVE-2021-274457.8Mesa Labs AmegaView Versions 3.0 and prior has insecure file permissions that could be exploited to escalate privileges on the device.CVE-2021-274469.8The Weintek cMT product line is vulnerable to code injection, which may allow an unauthenticated remote attacker to execute commands with ro CVE-2021-274479.8Mesa Labs AmegaView version 3.0 is vulnerable to a command injection, which may allow an attacker to remotely execute arbitrary code.CVE-2021-274487.8A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E (all firmware versio CVE-2021-274498.8Mesa Labs AmegaView Versions 3.0 and prior has a command injection vulnerability that can be exploited to execute commands in the web server CVE-2021-274507.8SSH server configuration file does not implement some best practices. This could lead to a weakening of the SSH protocol strength, which cou