PT-2022-6141 · Advantech · Advantech Iview

Published 2022-08-09 · Updated 2022-09-29 · CVE-2022-3323

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advantech iView version 5.7.04.6469

Description The issue is related to an SQL injection vulnerability. It exists within the "ConfigurationServlet" endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column value parameter in the setConfiguration action to bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() and perform SQL injection. This could allow the attacker to retrieve the iView admin password.

Recommendations For Advantech iView version 5.7.04.6469, consider disabling the setConfiguration action in the "ConfigurationServlet" endpoint until a patch is available. Restrict access to the ConfigurationServlet endpoint to minimize the risk of exploitation. Avoid using the column value parameter in the setConfiguration action until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-00157

CVE-2022-3323

Affected Products

Advantech Iview

References · 5

• 🔥 https://tenable.com/security/research/tra-2022-32 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3323 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3323 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00157 · Security Note
• https://t.me/cvenotify/36892 · Telegram Post