CVE-2025-53475: fallo de gravedad alta en Advantech iView
Advantech iView SQL Injection
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.7epss 7.4%
A vulnerability exists in Advantech iView that could allow for SQL
injection and remote code execution through
NetworkServlet.getNextTrapPage(). This issue requires an authenticated
attacker with at least user-level privileges. Certain parameters in this
function are not properly sanitized, allowing an attacker to perform
SQL injection and potentially execute code in the context of the 'nt
authority\local service' account.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
Advantech · iViewCVEs relacionadas — Advantech iView
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-46704MEDIUMAdvantech iView Path TraversalEPSS 5.7%CVE-2023-52335HIGHAdvantech iView ConfigurationServlet SQL Injection Information Disclosure VulnerabilityEPSS 1.3%CVE-2022-50593CRITICALAdvantech iView < v5.7.04 Build 6425 search_term Parameter SQL Injection RCEEPSS 0.7%CVE-2022-50595CRITICALAdvantech iView < v5.7.04 Build 6425 ztp_search_value Parameter SQL Injection RCEEPSS 0.7%CVE-2022-50592CRITICALAdvantech iView < v5.7.04 Build 6425 getInventoryReportData Parameter SQL Injection RCEEPSS 0.7%CVE-2025-53515HIGHAdvantech iView SQL InjectionEPSS 0.6%