Description Summary:
Advantech WISE-6610 contains an OS command injection vulnerability in the background management interface that allows remote attackers to execute arbitrary commands.

Executive Summary:
A remote OS command injection vulnerability in Advantech WISE-6610 poses a significant risk of unauthorized system control due to the availability of public exploit material.

Vulnerability Details

CVE-ID: CVE-2026-2670

Affected Software: Advantech WISE-6610

Affected Versions: 1.2.1_20251110

Vulnerability: This vulnerability involves OS command injection within the /cgi-bin/luci/admin/openvpn_apply endpoint. By manipulating the delete_file argument, an authenticated attacker with high privileges can execute arbitrary operating system commands on the device.

Business Impact

Successful exploitation of this flaw allows an attacker to achieve full remote command execution on the affected gateway. This could lead to complete system compromise, the potential for lateral movement within the operational technology network, and unauthorized access to sensitive configuration data. Given the CVSS score of 7.2, this vulnerability represents a high-severity risk that requires immediate attention to prevent device takeover.

Remediation Plan

Immediate Action: Since the vendor has not provided a security update, administrators should immediately restrict network access to the management interface of the WISE-6610 to trusted management workstations only.

Proactive Monitoring: Monitor device logs for unusual activity or unauthorized requests targeting the /cgi-bin/luci/admin/openvpn_apply endpoint.

Compensating Controls: Implement strict firewall rules to block external access to the web management interface and utilize a Web Application Firewall to filter requests containing suspicious command injection patterns.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up referenced by the CVE record.

Analyst Notes: As of February 19, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input sanitization in the management interface.

Analyst Recommendation

The presence of a public proof-of-concept combined with the potential for full system compromise makes this a high-priority issue. Network administrators must isolate the affected hardware from the public internet immediately. Until the vendor releases a formal patch, limiting management access is the most effective strategy to prevent unauthorized exploitation of this device.

Description Summary:
Advantech Hospital Queuing Management contains a sensitive data exposure vulnerability that allows unauthenticated remote attackers to access API documentation.

Executive Summary:
A sensitive data exposure vulnerability in Advantech Hospital Queuing Management allows unauthenticated attackers to access internal API documentation, facilitating further reconnaissance.

Vulnerability Details

CVE-ID: CVE-2026-14162

Affected Software: Advantech Hospital Queuing Management

Affected Versions: See vendor advisory

Vulnerability: The software fails to enforce authentication for a specific URL endpoint, resulting in the exposure of sensitive API documentation to unauthenticated remote attackers.

Business Impact

While the CVSS score of 9.8 reflects the severity of exposing internal system architecture, the primary risk is reconnaissance. Access to API documentation provides attackers with a roadmap of the application's internal functions, significantly lowering the barrier for discovering and exploiting additional, more severe vulnerabilities.

Remediation Plan

Immediate Action: Update the Advantech Hospital Queuing Management software to the latest version to restrict access to sensitive documentation endpoints.

Proactive Monitoring: Monitor logs for unauthorized access attempts to administrative or documentation-related URLs.

Compensating Controls: Implement access control lists (ACLs) or authentication requirements at the network perimeter or reverse proxy level to prevent unauthenticated access to the application.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jun 30, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Although this vulnerability does not provide direct code execution, the exposure of internal API documentation is a significant security lapse that aids attackers in planning targeted attacks. Security teams should prioritize patching to close this information disclosure vector and prevent further system mapping by unauthorized parties.

Description Summary:
A directory traversal vulnerability in Advantech DeviceOn/iEdge allows authenticated attackers to upload malicious configuration files, leading to remote code execution with system-level privileges.

Executive Summary:
A critical directory traversal vulnerability in Advantech DeviceOn and iEdge software allows authenticated attackers to achieve remote code execution with system-level permissions.

Vulnerability Details

CVE-ID: CVE-2025-62630

Affected Software: Advantech DeviceOn/iEdge

Affected Versions: 0 through 2.0.2

Vulnerability: The flaw is a directory traversal vulnerability (CWE-22) triggered by the insufficient sanitization of configuration files during upload. An attacker with low-level authenticated access can manipulate file paths to execute arbitrary code with system-level permissions.

Business Impact

Successful exploitation of this vulnerability grants an attacker full control over the affected device with system-level permissions. This level of access poses a severe risk to operational technology environments, potentially leading to unauthorized system manipulation, total loss of data confidentiality and integrity, and significant operational downtime. With a CVSS score of 8.8, this vulnerability is considered High severity and requires immediate attention to prevent system compromise.

Remediation Plan

Immediate Action: Advantech has classified these products as end-of-life and recommends that all users migrate their systems to the current DeviceOn platform, which is not affected by this vulnerability.

Proactive Monitoring: Security teams should monitor network traffic for anomalous file upload activity and review system logs for unauthorized configuration changes or unexpected process execution.

Compensating Controls: If immediate migration is not feasible, restrict network access to the affected devices using firewall rules to ensure only trusted administrative endpoints can reach the management interface.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of November 7, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires low-level authentication, the resulting system-level code execution makes it a high-priority target for lateral movement within industrial networks.

Analyst Recommendation

Given the end-of-life status of the affected products, patching is not an option. Organizations must prioritize the migration to the current DeviceOn platform as the primary method to eliminate this risk. Until migration is complete, isolating the affected systems from the wider corporate network is essential to prevent potential exploitation.

Description Summary:
Advantech DeviceOn/iEdge versions 0 through 2.0.2 are vulnerable to path traversal via malicious configuration file uploads, potentially leading to remote code execution with system-level privileges.

Executive Summary:
Unauthenticated attackers can achieve remote code execution on Advantech DeviceOn and iEdge devices by exploiting a path traversal vulnerability during configuration file uploads.

Vulnerability Details

CVE-ID: CVE-2025-59171

Affected Software: Advantech DeviceOn/iEdge

Affected Versions: 0 through 2.0.2

Vulnerability: This vulnerability is a path traversal flaw (CWE-22) caused by insufficient sanitization of configuration files. An unauthenticated attacker can exploit this to achieve remote code execution with system-level permissions.

Business Impact

The potential for remote code execution with system-level privileges presents a critical risk to operational technology environments. Successful exploitation allows for complete compromise of the affected device, potentially leading to unauthorized control of industrial processes, loss of data integrity, and significant system downtime. With a CVSS score of 7.5, this high-severity vulnerability requires immediate attention to prevent unauthorized access to critical infrastructure components.

Remediation Plan

Immediate Action: Because the affected products have reached end-of-life status, users must migrate to the current DeviceOn platform, which is not affected by this vulnerability. Contact Advantech support directly for migration assistance and upgrade paths.

Proactive Monitoring: Review device access logs for unusual file upload activity or unauthorized configuration changes. Monitor network traffic for anomalous connections originating from or directed toward these devices.

Compensating Controls: Deploy a Web Application Firewall (WAF) or industrial firewall to restrict access to the device management interface. Isolate these devices within a segmented network to limit the potential reach of an attacker.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of November 7, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation remains unconfirmed, the ability to achieve remote code execution without authentication makes this a high-priority risk for all deployments.

Analyst Recommendation

Given that these devices are end-of-life and no patch will be issued, the primary mitigation is immediate decommissioning and migration to supported software. The high risk of remote code execution necessitates that these devices be removed from public-facing networks or isolated immediately until the migration process is complete. Failure to address this vulnerability exposes the environment to significant risk of unauthorized system control.

Description Summary:
A path traversal vulnerability in Advantech DeviceOn/iEdge allows authenticated attackers to perform file read/write operations or cause a denial-of-service via crafted configuration files.

Executive Summary:
A critical path traversal vulnerability in Advantech DeviceOn and iEdge products allows authenticated attackers to execute arbitrary file operations or disrupt service with system-level privileges.

Vulnerability Details

CVE-ID: CVE-2025-58423

Affected Software: Advantech DeviceOn/iEdge

Affected Versions: 0 through 2.0.2

Vulnerability: This vulnerability, classified as CWE-22, occurs due to insufficient input sanitization during the processing of configuration files, allowing an authenticated user to perform directory traversal and unauthorized file system manipulation.

Business Impact

The ability to read or write files within the context of the local system account presents a severe risk of unauthorized data access and potential system compromise. Given the CVSS score of 8.8, this vulnerability carries a high risk of total loss of confidentiality, integrity, and availability for the affected device, potentially leading to operational downtime or the exfiltration of sensitive configuration data.

Remediation Plan

Immediate Action: As the affected products are end-of-life, users must transition to the current Advantech DeviceOn platform, which is not susceptible to this vulnerability.

Proactive Monitoring: Monitor system logs for unusual file access patterns or unexpected configuration upload attempts that deviate from standard administrative workflows.

Compensating Controls: Restrict access to the management interface to authorized personnel only, and implement network segmentation to isolate the affected devices from untrusted network segments.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of November 7, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the resulting system-level privileges, but exploitation requires an authenticated session.

Analyst Recommendation

The severity of this issue is compounded by the end-of-life status of the affected software, which precludes the availability of security patches. Organizations currently utilizing Advantech DeviceOn or iEdge versions 2.0.2 and below should prioritize an immediate migration to the supported DeviceOn platform to eliminate this security risk.

Description Summary:
Advantech iView contains a SQL injection vulnerability in the NetworkServlet component that allows authenticated users to achieve remote code execution.

Executive Summary:
A critical SQL injection vulnerability in Advantech iView allows authenticated attackers to gain remote code execution, posing a significant risk to system integrity and service availability.

Vulnerability Details

CVE-ID: CVE-2025-53515

Affected Software: Advantech iView

Affected Versions: 0 up to (excluding) 5.7.05 build 7057

Vulnerability: The vulnerability exists within the NetworkServlet.archiveTrap() function, where insufficient input sanitization allows an authenticated attacker with user-level privileges to perform SQL injection. This flaw can be leveraged to execute arbitrary code under the context of the NT AUTHORITY\LOCAL SERVICE account.

Business Impact

The ability for an authenticated user to execute remote code on the server represents a high-severity threat to business operations. Given the CVSS score of 8.8, this flaw could lead to full system compromise, unauthorized data access, and potential lateral movement within the network. Organizations relying on iView for critical infrastructure management face significant risks of service disruption and data loss if this vulnerability is exploited.

Remediation Plan

Immediate Action: Update Advantech iView to version 5.7.05 build 7057 or later immediately to resolve the vulnerable code path in the NetworkServlet component.

Proactive Monitoring: Review system and application access logs for unusual SQL queries or unexpected process execution originating from the iView service account.

Compensating Controls: Implement strict network segmentation to limit access to the iView management interface and employ a Web Application Firewall (WAF) to detect and block common SQL injection patterns.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of July 11, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires authentication, the potential for remote code execution makes it a high-priority target for malicious actors.

Analyst Recommendation

Due to the potential for remote code execution, this vulnerability should be treated with high urgency. Administrators must prioritize the application of the vendor-provided patch to remediate the underlying SQL injection flaw. Until the update can be deployed, ensure that access to the iView application is restricted to authorized personnel only to mitigate the risk of exploitation by malicious insiders or compromised user accounts.

Description Summary:
Advantech iView contains a SQL injection vulnerability in the NetworkServlet.getNextTrapPage() function, potentially allowing remote code execution for an authenticated user.

Executive Summary:
A critical SQL injection vulnerability in Advantech iView, which can be leveraged by an authenticated attacker to achieve remote code execution, necessitates an immediate update to version 5.7.05.

Vulnerability Details

CVE-ID: CVE-2025-53475

Affected Software: Advantech iView

Affected Versions: Advantech iView: 0 up to (excluding) 5.7.05 build 7057

Vulnerability: The application fails to properly sanitize input parameters within the NetworkServlet.getNextTrapPage() function, resulting in a CWE-89 SQL injection flaw. This vulnerability can be exploited by an attacker with at least user-level authenticated privileges to execute arbitrary code under the context of the NT AUTHORITY\LOCAL SERVICE account.

Business Impact

The ability to execute arbitrary code on an industrial management system poses a severe risk to organizational operations, potentially leading to unauthorized data access, system compromise, or service disruption. Given the CVSS score of 8.8, this vulnerability is classified as High severity, reflecting the significant potential for total impact on system integrity and availability if the management server is breached.

Remediation Plan

Immediate Action: Update Advantech iView to version 5.7.05 build 7057 or later immediately to remediate the vulnerable code path.

Proactive Monitoring: Review system access logs for unusual activity originating from authenticated user accounts, specifically focusing on requests directed toward NetworkServlet.

Compensating Controls: Restrict access to the iView management interface to trusted internal networks and implement rigorous credential management to prevent unauthorized access to user-level accounts.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability requires authentication, the potential for remote code execution makes it a high-priority target for internal threat actors or compromised accounts.

Analyst Recommendation

Given the potential for full system compromise via remote code execution, security teams must prioritize the deployment of the vendor-supplied patch. Organizations should verify that all instances of Advantech iView are updated to build 7057 and strictly limit administrative and user access to the management console to mitigate the risk of credential misuse.

Description Summary:
A critical SQL injection vulnerability in multiple Advantech industrial software products allows unauthenticated remote attackers to execute arbitrary SQL commands.

Executive Summary:
An unauthenticated remote SQL injection vulnerability in Advantech industrial software products poses a critical risk of full system compromise and data exfiltration.

Vulnerability Details

CVE-ID: CVE-2025-52694

Affected Software: Advantech IoTSuite, IoT Edge, WebAccess/SCADA, and ECOWatch

Affected Versions: See metadata for specific version thresholds per product line.

Vulnerability: The vulnerability is a SQL injection flaw that permits an unauthenticated remote attacker to execute arbitrary SQL commands directly against the database tier of the affected services. This occurs because the software fails to properly sanitize user-supplied input before processing it within database queries.

Business Impact

The CVSS score of 10.0 reflects the maximum severity, as this flaw enables complete control over the underlying database and potentially the host system. Successful exploitation allows for the theft of sensitive industrial data, modification of operational integrity, and potential disruption of critical infrastructure services, leading to significant reputational and operational damage.

Remediation Plan

Immediate Action: Update all affected Advantech product instances to the latest versions provided by the vendor, referencing the specific guidance for each product line.

Proactive Monitoring: Monitor database query logs for unusual syntax, such as union-based injections or unexpected administrative commands, and audit access logs for unauthorized connection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to filter malicious traffic directed at the web interface of these services.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists on GitHub.

Analyst Notes: As of Jan 12, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept repository is available, which significantly lowers the barrier for entry for threat actors. Given the high EPSS score and the nature of the flaw, the risk of automated exploitation against internet-exposed instances is extremely high.

Analyst Recommendation

This vulnerability represents a critical security failure that requires immediate attention. Organizations must prioritize patching all internet-facing Advantech instances to the specified fixed versions to prevent unauthorized database access. If immediate patching is not possible, the services should be removed from public network access until remediation is completed.

Description Summary:
Advantech iView contains a SQL injection vulnerability in the NetworkServlet.archiveTrapRange() function that can lead to remote code execution by an authenticated user.

Executive Summary:
A critical SQL injection vulnerability in Advantech iView allows authenticated attackers to achieve remote code execution, posing a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2025-52577

Affected Software: Advantech iView

Affected Versions: 0 up to (excluding) 5.7.05 build 7057

Vulnerability: The application fails to properly sanitize input parameters within the NetworkServlet.archiveTrapRange() function. This flaw permits an authenticated attacker with at least user-level privileges to perform SQL injection and execute code under the context of the NT AUTHORITY\LOCAL SERVICE account.

Business Impact

The ability for an attacker to execute arbitrary code on the underlying host represents a significant threat to operational continuity and data confidentiality. Given the CVSS score of 8.8, this vulnerability is classified as High severity and could allow an attacker to gain full control over the affected management server, potentially facilitating lateral movement within the network.

Remediation Plan

Immediate Action: Update Advantech iView to version 5.7.05 build 7057 or later as provided in the vendor security advisory.

Proactive Monitoring: Monitor system access logs for unusual administrative activity or suspicious SQL query patterns directed at the NetworkServlet endpoint.

Compensating Controls: Restrict network access to the iView management interface to trusted IP addresses only and ensure that user accounts follow the principle of least privilege to limit the impact of potential account compromise.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of July 11, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for authenticated access significantly reduces the attack surface, but the potential for remote code execution demands prompt attention.

Analyst Recommendation

This vulnerability presents a high risk due to the potential for remote code execution. Security teams should prioritize patching all instances of Advantech iView within their environment to the latest version immediately to eliminate the underlying SQL injection flaw.

Description Summary:
A SQL injection vulnerability in the Advantech iView CUtils.checkSQLInjection function allows authenticated users to potentially cause information disclosure or a denial of service.

Executive Summary:
An authenticated SQL injection vulnerability in Advantech iView poses a risk of information disclosure and service disruption, necessitating an immediate software update.

Vulnerability Details

CVE-ID: CVE-2025-48891

Affected Software: Advantech iView

Affected Versions: 0 up to (excluding) 5.7.05 build 7057

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) triggered via the CUtils.checkSQLInjection function. The vulnerability is accessible to any authenticated attacker holding at least user-level privileges.

Business Impact

Successful exploitation of this vulnerability could allow an attacker to execute unauthorized database queries, leading to the compromise of sensitive industrial management data. Given the CVSS score of 7.6, this is classified as a High severity issue that may result in both unauthorized information disclosure and potential system instability or denial of service within the operational environment.

Remediation Plan

Immediate Action: Update Advantech iView to version 5.7.05 build 7057 or later as specified in the vendor security advisory.

Proactive Monitoring: Review application and database access logs for anomalous query patterns or unauthorized attempts to access the CUtils module.

Compensating Controls: Implement strict network segmentation to limit access to the iView interface and deploy WAF rules to detect and block common SQL injection strings.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of July 10, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authenticated access reduces the overall attack surface, but the potential for lateral movement in industrial environments makes patching a priority.

Analyst Recommendation

Organizations utilizing Advantech iView must prioritize this update to mitigate the risk of database compromise. Administrators should verify their current build version immediately and schedule downtime to apply the vendor-provided patch, as failure to remediate could lead to unauthorized data access or disruption of critical monitoring functions.

Description Summary:
Advantech WebAccess/SCADA contains a directory traversal vulnerability that allows authenticated attackers to delete arbitrary files on the host system.

Executive Summary:
A directory traversal flaw in Advantech WebAccess/SCADA version 9.2.1 poses a significant risk to system integrity by allowing unauthorized file deletion.

Vulnerability Details

CVE-ID: CVE-2025-14850

Affected Software: Advantech WebAccess/SCADA

Affected Versions: 9.2.1

Vulnerability: The application is susceptible to a directory traversal vulnerability (CWE-22) that permits an authenticated user to traverse outside intended directories to delete arbitrary files on the underlying file system. Based on the CVSS vector (PR:L), this attack requires the user to have low-level privileges to interact with the vulnerable function.

Business Impact

Successful exploitation of this vulnerability could lead to the deletion of critical configuration, system, or application files, resulting in severe operational disruption or loss of availability for SCADA systems. With a CVSS score of 8.1, the high impact on file integrity and availability necessitates immediate attention, particularly in industrial control environments where uptime is critical.

Remediation Plan

Immediate Action: Update Advantech WebAccess/SCADA to version 9.2.2 or later as specified in the vendor advisory.

Proactive Monitoring: Monitor system logs for unusual file deletion activity or unauthorized attempts to access directories outside of the application's defined scope.

Compensating Controls: Restrict access to the WebAccess/SCADA interface to trusted internal networks only, and ensure that the service account running the application operates with the least privilege necessary to perform its functions.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of December 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is not currently observed, the nature of directory traversal in SCADA software makes it a high-value target for malicious actors seeking to disrupt industrial processes.

Analyst Recommendation

Given the critical role of SCADA systems in industrial operations, the risk posed by unauthorized file deletion is severe. Security teams should prioritize the update to version 9.2.2 to eliminate the underlying path traversal flaw. If patching is not immediately feasible, ensure strict network segmentation and identity controls are in place to prevent low-privileged users from accessing the vulnerable interface.

Description Summary:
Advantech WebAccess/SCADA contains an unrestricted file upload vulnerability that may allow a remote, authenticated attacker to execute arbitrary code on the affected system.

Executive Summary:
A critical unrestricted file upload vulnerability in Advantech WebAccess/SCADA allows authenticated attackers to execute arbitrary code, posing a significant risk to industrial control environments.

Vulnerability Details

CVE-ID: CVE-2025-14849

Affected Software: Advantech WebAccess/SCADA

Affected Versions: 9.2.1

Vulnerability: The application is susceptible to an unrestricted file upload flaw (CWE-434), which enables an attacker with authenticated access to upload and execute malicious files. According to the CVSS vector, this requires low privileges to exploit, but it does not require user interaction to trigger remote code execution.

Business Impact

Successful exploitation of this vulnerability can lead to a full compromise of the SCADA environment, resulting in unauthorized control of industrial processes, data theft, or complete system downtime. With a CVSS score of 8.8, this vulnerability is classified as High severity. Given the nature of SCADA systems, the potential for operational disruption and physical safety implications makes remediation a top priority for facility security teams.

Remediation Plan

Immediate Action: Update Advantech WebAccess/SCADA to version 9.2.2 or later as specified by the vendor advisory.

Proactive Monitoring: Monitor system logs for unusual file creation events in web directories and audit user activity for suspicious account behavior.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect and block unauthorized file uploads and restrict access to the WebAccess/SCADA interface to trusted internal networks only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of December 20, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the flaw is not currently being exploited in the wild, the ability to execute arbitrary code makes it highly dangerous if an attacker gains initial access to the application.

Analyst Recommendation

The risk posed by arbitrary code execution in a SCADA environment is extreme. Administrators should prioritize patching to version 9.2.2 immediately to eliminate the underlying vulnerability. Organizations unable to patch immediately must implement strict network segmentation and WAF rules to prevent unauthorized access to the application and restrict the ability to upload files to the server.

Description Summary:
An improper access control vulnerability in the Advantech SUSI driver allows local attackers to perform unauthorized memory, I/O port, and MSR operations, leading to privilege escalation.

Executive Summary:
A critical privilege escalation vulnerability in the Advantech SUSI driver allows local attackers to gain full system control via arbitrary memory and I/O manipulation.

Vulnerability Details

CVE-ID: CVE-2025-14252

Affected Software: Advantech SUSI driver

Affected Versions: 0 through 5.0.24335

Vulnerability: This is an improper access control flaw (CWE-284) within the susi.sys driver. It allows an attacker with low privileges to read or write arbitrary memory, I/O ports, and Model Specific Registers (MSRs).

Business Impact

The ability to perform arbitrary memory and I/O operations grants an attacker full system control, bypassing standard security boundaries. With a CVSS score of 7.8, this high-severity vulnerability poses a significant threat to data confidentiality, integrity, and system availability. Successful exploitation could lead to full machine compromise, unauthorized data exfiltration, or the installation of persistent malicious payloads.

Remediation Plan

Immediate Action: Contact Advantech support or monitor the official PSIRT advisory portal for the release of a patched driver version. Until a patch is verified, restrict access to systems utilizing the affected SUSI driver to only trusted, authorized users.

Proactive Monitoring: Monitor system logs for unauthorized attempts to access or load kernel-level drivers. Review endpoint detection and response (EDR) alerts for suspicious process activity originating from local user accounts.

Compensating Controls: Implement strict principle-of-least-privilege policies to ensure that standard users cannot interact with sensitive system drivers. Utilize kernel-mode code signing and driver blocklisting features to prevent the loading of known vulnerable or malicious drivers.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of December 17, 2025, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's requirement for local access (AV:L) somewhat limits its attack surface, though its potential for full system compromise remains high.

Analyst Recommendation

Given the potential for full system compromise via arbitrary code execution, this vulnerability represents a significant risk to industrial or embedded environments using Advantech hardware. Administrators should prioritize identifying all systems running the affected SUSI driver version and prepare to deploy the vendor-supplied fix immediately upon release.

Description Summary:
Advantech iView versions 5.7.05.7057 and prior are vulnerable to SQL injection via unsanitized SNMP v1 trap requests on port 162.

Executive Summary:
An unauthenticated SQL injection vulnerability in Advantech iView 5.7.05.7057 and prior allows remote attackers to execute arbitrary database commands.

Vulnerability Details

CVE-ID: CVE-2025-13373

Affected Software: Advantech iView

Affected Versions: 5.7.05.7057 and prior

Vulnerability: This vulnerability involves improper neutralization of special elements used in SQL commands (CWE-89). Unauthenticated attackers can trigger the flaw by sending malicious SNMP v1 trap requests to port 162.

Business Impact

The ability to perform SQL injection against a network management platform presents a significant risk to data confidentiality. Successful exploitation could allow an attacker to extract sensitive system information, potentially leading to unauthorized access to the underlying management infrastructure and broader network compromise. Given the CVSS score of 7.5, this is classified as a High severity issue requiring immediate attention to prevent data exfiltration.

Remediation Plan

Immediate Action: Update Advantech iView to version 5.8.1 or later as specified in the vendor advisory.

Proactive Monitoring: Review system logs for unusual SNMP traffic patterns or malformed SNMP trap requests originating from untrusted sources.

Compensating Controls: Restrict access to UDP port 162 to known, trusted management stations using network segmentation or firewall rules to prevent unauthorized SNMP trap submission.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of 2025-12-05, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered highly automatable due to the lack of required authentication, which increases the necessity for prompt patching.

Analyst Recommendation

This vulnerability represents a critical risk to industrial control and network management environments. Organizations utilizing Advantech iView should prioritize the transition to version 5.8.1 to eliminate the SQL injection vector. Until the update is applied, strict network access control lists for SNMP traffic are essential to mitigate the risk of remote command execution.