CVE-2021-22851: HGiga OAKloud Portal - SQL injection -1

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-01-19 · updated 2026-06-17
Weakness: CWE-89

Description

HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data.

Affected products

HGiga Oaklouds Openid: from 2.0 before 2.0-54; from 3.0 before 3.0-54 — fixed in 2.0-54, 3.0-54

How to fix

Upgrade to a fixed version: HGiga Oaklouds Openid 2.0-54, 3.0-54. Check the vendor advisory for mitigations.

References

https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef
https://www.twcert.org.tw/tw/cp-132-4327-50e99-1.html
https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef
https://www.twcert.org.tw/tw/cp-132-4327-50e99-1.html

Get alerted when CVE-2021-22851 or the next vulnerability affects your stack