CVE-2021-42703 : Security Advisory and Response

AzeoTech DAQFactory vulnerability affecting Advantech HMI Designer versions <= 2.1.11.0.

Understanding CVE-2021-42703

This CVE involves a potential security risk in Advantech's HMI Designer application.

What is CVE-2021-42703?

CVE-2021-42703 is a Cross-site Scripting (XSS) vulnerability in Advantech's HMI Designer software that could allow an attacker to execute malicious scripts, leading to various security threats.

The Impact of CVE-2021-42703

The vulnerability could enable an attacker to compromise user sessions, redirect users to harmful websites, and perform unauthorized actions within the browser.

Technical Details of CVE-2021-42703

Details regarding the specific aspects of this CVE.

Vulnerability Description

The flaw allows attackers to inject malicious JavaScript code, potentially leading to the hijacking of user sessions and other harmful activities.

Affected Systems and Versions

Product: HMI Designer
Vendor: Advantech
Versions affected: <= 2.1.11.0 (All versions)

Exploitation Mechanism

Attack Complexity: Low
Attack Vector: Network
Required User Interaction: Yes
Impact Severity: Medium
CWE-79: Cross-site Scripting (XSS)

Mitigation and Prevention

Guidelines to address and prevent exploitation of CVE-2021-42703.

Immediate Steps to Take

Users are advised to update to the latest version of WebAccess HMI Designer v2.1.11.0 immediately.

Long-Term Security Practices

Regularly monitor and patch software vulnerabilities.
Educate users on safe browsing habits to mitigate XSS risks.

Patching and Updates

Advantech recommends updating to the latest version of the HMI Designer to address this vulnerability.