CVE-2023-52335: falha de alta gravidade em Advantech iView
Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.5epss 1.3%
Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the ConfigurationServlet servlet, which listens on TCP port 8080 by default. When parsing the column_value element, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-17863.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
Advantech · iViewCVEs relacionadas — Advantech iView
No mesmo produto, das mais perigosas para as menos.
CVE-2025-53475HIGHAdvantech iView SQL InjectionEPSS 7.4%CVE-2025-46704MEDIUMAdvantech iView Path TraversalEPSS 5.7%CVE-2022-50593CRITICALAdvantech iView < v5.7.04 Build 6425 search_term Parameter SQL Injection RCEEPSS 0.7%CVE-2022-50595CRITICALAdvantech iView < v5.7.04 Build 6425 ztp_search_value Parameter SQL Injection RCEEPSS 0.7%CVE-2022-50592CRITICALAdvantech iView < v5.7.04 Build 6425 getInventoryReportData Parameter SQL Injection RCEEPSS 0.7%CVE-2025-53515HIGHAdvantech iView SQL InjectionEPSS 0.6%