CVE-2021-22852: HGiga OAKloud Portal - SQL injection -2

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-01-19 · updated 2026-06-17
Weakness: CWE-89

Description

HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (online registration) to obtain database schema and data.

Affected products

HGiga Oaklouds Openid: from 2.0 before 2.0-54; from 3.0 before 3.0-54 — fixed in 2.0-54, 3.0-54

How to fix

Upgrade to a fixed version: HGiga Oaklouds Openid 2.0-54, 3.0-54. Check the vendor advisory for mitigations.

References

https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef
https://www.twcert.org.tw/tw/cp-132-4328-97765-1.html
https://www.chtsecurity.com/news/eb024200-7cf9-4c58-a063-c451dbc9daef
https://www.twcert.org.tw/tw/cp-132-4328-97765-1.html

Get alerted when CVE-2021-22852 or the next vulnerability affects your stack