The affected tool is R-SeeNet, which is designed to help network administrators monitor their Advantech routers.

Talos researchers discovered that R-SeeNet is affected by seven vulnerabilities, a majority of which have been assigned a critical severity rating.

An attacker can exploit the vulnerabilities to execute arbitrary JavaScript code in the targeted user’s browser by getting them to click on a malicious link, execute arbitrary OS commands using specially crafted HTTP requests, or execute PHP commands via malicious HTTP requests. Many of these security holes can be exploited even if the victim is not logged in, Talos noted.