PT-2025-45366 · Advantech · Advantech Iview

Exodus Intelligence · Published 2022-03-01 · Updated 2025-11-24 · CVE-2022-50591

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Advantech iView versions prior to 5.7.04 build 6425

Description The software contains a flaw within the SNMP management tool that permits remote attackers to circumvent authentication procedures and exploit a SQL injection issue. The SQL injection occurs through the ztp config id parameter in the /NetworkServlet API endpoint. Successful exploitation can lead to the unauthorized disclosure of user data, including passwords stored in plain text.

Recommendations Update to version 5.7.04 build 6425 or later.

Fix

Missing Authentication

SQL injection

Weakness Enumeration

CWE-306

CWE-89

Related Identifiers

BDU:2025-14779

CVE-2022-50591

Affected Products

Advantech Iview

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2022-50591 · Security Note
• https://osv.dev/vulnerability/CVE-2022-50591 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14779 · Security Note
• https://advantech.tw/support/details/firmware?id=1-HIPU-183 · Patch, Vendor Advisory
• https://t.me/cveNotify/143855 · Telegram Post
• https://vulncheck.com/advisories/advantech-iview-ztpconfigid-parameter-sqli-information-disclosure · Note
• https://tenable.com/cve/CVE-2022-50591 · Note
• https://blog.exodusintel.com/2022/03/01/advantech-iview-ztp_config_id-parameter-sql-injection-information-disclosure-vulnerability · Note