CVE-2021-21799

Vulnerability

The telnet_form.php script in Advantech R-SeeNet v2.4.12 (20.10.2020) contains a cross-site scripting (XSS) vulnerability in the hostname parameter. The parameter is taken directly from the HTTP GET request without sanitization and embedded into the HTML `` tag on line 44, allowing injection of arbitrary JavaScript. [1]

Exploitation

An attacker can craft a URL with a malicious hostname parameter, such as ``, and trick a user into visiting it. No authentication or special network position is required beyond the victim's browser accessing the vulnerable R-SeeNet instance. [1]

Impact

Successful exploitation allows arbitrary JavaScript execution in the context of the victim's browser, potentially leading to session hijacking, credential theft, or other actions with the same privileges as the logged-in user. [1]

Mitigation

As of the publication date, no official fix has been disclosed in the available references. Users should monitor the vendor for updates and consider restricting access to the R-SeeNet web interface or applying a web application firewall rule to block malicious hostname inputs. [1]