CVE-2025-52694

CVE-2025-52694 is a critical (CVSS 9.8) SQL injection flaw (CWE-89) affecting multiple Advantech industrial IoT platform products, including IoT Edge (Linux Docker and Windows) and IoTSuite (Growth/Starter Linux Docker and SaaS Composer). An unauthenticated remote attacker can send crafted input to an internet-exposed vulnerable service, where it is processed as SQL commands. Successful exploitation could compromise the confidentiality, integrity, and availability of data handled by the service, potentially enabling data theft, modification, or denial of service. Users and administrators running affected versions of these Advantech products—especially with the service reachable from the Internet—are affected and are advised to update immediately. There is no confirmed in-the-wild exploitation, no public proof-of-concept, and the flaw is not yet in CISA KEV, but an EPSS score of 40.4% (99th percentile) indicates a high probability of exploitation within the next 30 days.

What to do: Immediately update all affected Advantech IoT Edge and IoTSuite components to the latest versions per Advantech's advisory, as specific fixed version numbers are not provided in the available data. Until patched, restrict Internet-facing exposure of these services via firewall rules or a reverse proxy/WAF, and review service logs for anomalous SQL activity or unauthenticated requests. After patching, verify that the service is no longer reachable directly from the Internet.