CVE-2025-53515

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-53515
A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution through NetworkServlet.archiveTrap(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not sanitized, allowing an attacker to perform SQL injection and potentially execute code in the context of the 'nt authority\local service' account.
CVSS

No CVSS.

References
Link Resource
https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183 Product
https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

cpe:2.3:a:advantech:iview:*:*:*:*:*:*:*:*
History

01 Aug 2025, 19:13

Type Values Removed Values Added
CPE cpe:2.3:a:advantech:iview:*:*:*:*:*:*:*:*
First Time Advantech
Advantech iview
References () https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08 - () https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08 - Third Party Advisory, US Government Resource
References () https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183 - () https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183 - Product

11 Jul 2025, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-11 00:15

Updated : 2025-08-01 19:13

NVD link : CVE-2025-53515

Mitre link : CVE-2025-53515

JSON object : View

Products Affected

advantech

  • iview
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')