CVE-2021-21801

What it actually does

CVE-2021-21801 is a reflected cross-site scripting vulnerability in the Advantech R-SeeNet web application, specifically in the device_graph_page.php script. An attacker can craft a malicious URL containing JavaScript that is reflected into the page and executed in the victim’s browser when the victim visits the link. Because the code runs in the context of the R-SeeNet web application, it may read or modify page content, perform actions available to the victim, capture session-related data if accessible to script, or redirect the victim to attacker-controlled content. The CVSS scope change indicates compromise of the user’s browser context through the vulnerable application rather than direct server-side code execution.

Why it matters to the business

Successful exploitation can let an attacker abuse trusted R-SeeNet sessions, manipulate what users see, or perform limited actions as an authenticated user if the victim is logged in. For organizations using R-SeeNet to monitor or manage industrial or networked devices, this can undermine operator trust, expose sensitive operational information visible in the web interface, and support follow-on phishing or credential theft. Although it requires a victim to click or browse to a crafted URL, the exploit is described as weaponized and has a high EPSS score, so internet-exposed or broadly accessible R-SeeNet deployments should be treated as likely targets even though this issue is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an Advantech R-SeeNet deployment or users who access one. The attacker then crafts a URL targeting device_graph_page.php with malicious JavaScript embedded in a vulnerable parameter. The URL is delivered to a victim through phishing email, chat, a malicious web page, or another social-engineering channel. When the victim opens the link, the R-SeeNet application reflects the supplied input into the response without proper output encoding or sanitization. The victim’s browser executes the attacker’s script under the origin of the R-SeeNet web application. If the victim has an active authenticated session, the script may interact with the application as that user, read accessible page data, alter displayed information, issue same-origin requests, or redirect the browser to collect credentials or stage additional attacks.

How to fix it

Upgrade Advantech R-SeeNet to a vendor-supported release that contains the fix for this vulnerability, if available from Advantech support or the product download portal. Because no exact fixed version was provided in the input, confirm remediation guidance directly with Advantech advisories or support channels. As compensating controls, restrict access to the R-SeeNet web interface to trusted management networks or VPN users, disable direct internet exposure, require strong authentication, and add reverse-proxy or web application firewall rules to block obvious script payloads in requests to device_graph_page.php. Application-side fixes should include strict output encoding for all reflected values, input validation for expected parameter formats, use of HttpOnly and Secure session cookies, and a restrictive Content-Security-Policy to reduce script execution impact.

How to confirm the fix worked

Confirm the installed R-SeeNet version is vendor-supported and includes the vendor fix for the device_graph_page.php cross-site scripting issue. Test the web interface in a non-production or authorized environment by submitting harmless XSS test strings to device_graph_page.php parameters and verifying they are encoded as text rather than executed as script. Review HTTP responses for proper HTML/JavaScript context-aware output encoding and confirm that a restrictive Content-Security-Policy is present where feasible. Validate exposure by checking whether device_graph_page.php is reachable from the internet or untrusted networks. After mitigation, verify WAF or reverse-proxy controls block common XSS payloads and that session cookies are marked HttpOnly, Secure, and SameSite where supported.

Typical attack path

1. Identify an Advantech R-SeeNet web application and determine that device_graph_page.php is reachable.
2. Craft a URL containing JavaScript payloads in parameters processed by device_graph_page.php.
3. Send the malicious URL to an R-SeeNet user, operator, or administrator through phishing, messaging, or a hosted lure page.
4. Victim opens the URL while using a browser that can reach the R-SeeNet application.
5. The application reflects the payload into the page response without safe encoding.
6. The victim’s browser executes the JavaScript in the R-SeeNet application context.
7. Attacker uses the script to read accessible data, perform actions as the victim, redirect the user, or support credential/session theft depending on application and browser controls.

How to detect it

Review web server, reverse-proxy, WAF, and application access logs for requests to device_graph_page.php containing HTML tags, JavaScript protocol handlers, encoded script content, event-handler attributes, or references to external domains. Focus on requests followed by unusual redirects, unexpected authentication prompts, multiple requests from operator workstations to unfamiliar external hosts, or actions performed in R-SeeNet immediately after a suspicious link was opened. Browser history, endpoint telemetry, DNS logs, and proxy logs can help determine whether a victim visited a crafted URL and whether the injected script called out to attacker infrastructure. Because reflected XSS often leaves limited server-side artifacts, correlate suspicious URL parameters with user-agent, referrer, source IP, session activity, and any subsequent account or configuration changes in the application.

• device_graph_page.php?
• device_graph_page.php
• <script
• %3Cscript
• </script>
• %3C%2Fscript%3E
• javascript:
• javascript%3A
• onerror=
• onload=
• onclick=
• alert(
• document.cookie
• document.domain
• window.location
• eval(
• String.fromCharCode
• fetch(
• XMLHttpRequest
• <img
• %3Cimg
• <svg
• %3Csvg
• %22%3E%3Cscript
• '\"><script

What your security team should do

• Inventory all Advantech R-SeeNet instances and determine whether device_graph_page.php is reachable from untrusted networks.
• Prioritize remediation for internet-facing or shared-access R-SeeNet deployments because the exploit is weaponized and EPSS is high.
• Obtain the vendor-fixed R-SeeNet release or patch guidance from Advantech and upgrade affected installations.
• Until upgraded, restrict access to the R-SeeNet web interface with VPN, firewall allowlists, or management network segmentation.
• Deploy WAF or reverse-proxy filtering for script-like payloads targeting device_graph_page.php as a temporary control.
• Harden browser-facing controls, including HttpOnly/Secure/SameSite cookies and Content-Security-Policy, where configurable.
• Run retrospective log searches for suspicious requests to device_graph_page.php containing encoded script tags, event handlers, JavaScript URLs, or external callback domains.
• Educate R-SeeNet users and administrators not to open unsolicited links to the monitoring interface and to report unexpected login prompts or redirects.