Vulnerabilities

CVE-2025-52694 is a critical (CVSS 9.8) SQL injection flaw (CWE-89) affecting multiple Advantech industrial IoT platform products, including IoT Edge (Linux Docker and Windows) and IoTSuite (Growth/Starter Linux Docker and SaaS Composer). An unauthenticated remote attacker can send crafted input to an internet-exposed vulnerable service, where it is processed as SQL commands. Successful exploitation could compromise the confidentiality, integrity, and availability of data handled by the service, potentially enabling data theft, modification, or denial of service. Users and administrators running affected versions of these Advantech products—especially with the service reachable from the Internet—are affected and are advised to update immediately. There is no confirmed in-the-wild exploitation, no public proof-of-concept, and the flaw is not yet in CISA KEV, but an EPSS score of 40.4% (99th percentile) indicates a high probability of exploitation within the next 30 days.

Do: Immediately update all affected Advantech IoT Edge and IoTSuite components to the latest versions per Advantech's advisory, as specific fixed version numbers are not provided in the available data. Until patched, restrict Internet-facing exposure of these services via firewall rules or a reverse proxy/WAF, and review service logs for anomalous SQL activity or unauthenticated requests. After patching, verify that the service is no longer reachable directly from the Internet.

Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code.

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for signing EIRMMToken JWTs across all installations. The server accepts forged JWTs that need only contain a valid email claim, allowing a remote unauthenticated attacker to generate arbitrary tokens and impersonate any DeviceOn account, including the root super admin. Successful exploitation permits full administrative control of the DeviceOn instance and can be leveraged to execute code on managed agents through DeviceOn’s remote management features.

A heap corruption vulnerability exists in the Advantech TP-3250 printer driver's DrvUI_x64_ADVANTECH.dll (v0.3.9200.20789) when DocumentPropertiesW() is called with a valid dmDriverExtra value but an undersized output buffer. The driver incorrectly assumes the output buffer size matches the input buffer size, leading to invalid memory operations and heap corruption. This vulnerability can cause denial of service through application crashes and potentially lead to code execution in user space. Local access is required to exploit this vulnerability.

Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions.

Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as the web server user (www-data) by supplying a crafted uploaded filename.

Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘search_term’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for remote code execution with administrator privileges.

A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through NetworkServlet.getNextTrapPage(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters in this function are not properly sanitized, allowing an attacker to perform SQL injection and potentially execute code in the context of the 'nt authority\local service' account.

Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in other users’ browser, potentially leading to session hijacking, defacement, credential theft, or privilege escalation.

Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware through a public update page, potentially leading to backdoor installation or privilege escalation.