Security readout for executives and security teams
Plain-English summary
This vulnerability lets a low-privileged local attacker turn access on a system running Advantech DeviceOn/iEdge Server 1.0.2 into NT SYSTEM authority by replacing a file during the product's installation behavior. That is a full host compromise risk where the product is installed.
Executive priority
Prioritize remediation on any production or operational technology management systems running the affected version. The issue is not remotely exploitable per the CVSS vector, but a compromised local account could become NT SYSTEM and fully control the host.
Technical view
CVE-2021-40389 is a local privilege escalation in Advantech DeviceOn/iEdge Server 1.0.2. The CVSS vector is AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, scoring 8.8. The assigned weakness is CWE-276, indicating incorrect default permissions. Sources do not name a specific patch version.
Likely exposure
Exposure is most likely on Windows systems with Advantech DeviceOn/iEdge Server 1.0.2 installed, especially where non-administrative users or compromised accounts can write to relevant installation paths. The source bundle lists affected vendor/product fields as n/a, but the CVE description identifies DeviceOn/iEdge Server 1.0.2.
Exploitation context
The source bundle supports local, low-privilege exploitation with no user interaction. It does not show CISA KEV listing or any cited evidence of active exploitation. Treat exploit status as unknown, not confirmed active exploitation.
Researcher notes
The CVE record and Talos reference describe privilege escalation through replacement of a specially crafted file. Available metadata is incomplete for vendor/product CPEs and does not provide a named fixed release. Validation should focus on version presence, local privilege boundaries, and file permission exposure.
Mitigation direction
- Inventory systems for Advantech DeviceOn/iEdge Server 1.0.2.
- Check Advantech and Talos guidance for fixed versions or vendor mitigation.
- Restrict local login and write access on affected servers.
- Review and harden permissions on product installation directories.
- Monitor for unexpected file replacement in product paths.
Validation and detection
- Confirm whether DeviceOn/iEdge Server 1.0.2 is installed.
- Review filesystem ACLs around the installation location.
- Check endpoint logs for unusual file replacement activity.
- Verify whether vendor remediation has been applied.
- Prioritize hosts where low-privileged users have local access.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-276: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-40389 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (3.0)
- Known Exploited
- No
- Published
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H26Primary CVE scoreVulnerability scoring details
Base CVSS 3.0 score
8.8HighVector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://talosintelligence.com/vulnerability_reports/TALOS-2021-1400CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Default Permissions
Incorrect Default Permissions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.