CVE-2020-25157

Vulnerability

The R-SeeNet web interface in versions 1.5.1 through 2.4.10 contains an SQL injection vulnerability (CWE-89) [1]. The vulnerable code does not properly neutralize special elements used in SQL commands, allowing an attacker to inject arbitrary SQL queries. The vulnerability is reachable remotely without authentication [1].

Exploitation

An attacker with network access to the R-SeeNet web application can exploit this vulnerability by sending crafted HTTP requests containing malicious SQL statements [1]. No authentication or user interaction is required. The attack complexity is low, and the skill level needed is low [1].

Impact

Successful exploitation allows the attacker to retrieve sensitive information from the R-SeeNet database [1]. The confidentiality impact is high, while integrity and availability are not affected. The CVSS v3 base score is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) [1].

Mitigation

Advantech recommends updating to version 2.4.11 or later [1]. Additionally, CISA advises minimizing network exposure, using firewalls, and employing VPNs for remote access [1]. If an immediate update is not possible, restrict access to the R-SeeNet web interface to trusted networks only.