PT-2022-6346 · Advantech · Advantech Iview

Rgod · Published 2022-06-28 · Updated 2022-07-28 · CVE-2022-2137

Positive Technologies (AI Summary)

CVSS v2.0

6.1

Medium

Base vector

AV:N/AC:L/Au:M/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Advantech iView (affected versions not specified)

Description The issue is related to SQL injections that require high privileges for exploitation, potentially allowing an unauthorized attacker to disclose protected information. The vulnerability is associated with a lack of protection for the SQL query structure in the centralized network device and port management system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-00992

CVE-2022-2137

ZDI-22-926

ZDI-22-927

Affected Products

Advantech Iview

References · 10

• https://osv.dev/vulnerability/CVE-2022-2137 · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-22-926 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-2137 · Security Note
• https://bdu.fstec.ru/vul/2023-00992 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-22-927 · Security Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-179-03 · Note
• https://t.me/cibsecurity/46808 · Telegram Post
• https://zerodayinitiative.com/advisories/ZDI-CAN-16746 · Note
• https://t.me/cvenotify/33627 · Telegram Post
• https://t.me/cvenotify/33949 · Telegram Post