PT-2025-45367 · Advantech · Advantech Iview

Exodus Intelligence · Published 2022-01-13 · Updated 2025-11-24 · CVE-2022-50592

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Advantech iView versions prior to 5.7.04 build 6425

Description The software contains a flaw within the SNMP management tool that permits remote attackers to circumvent authentication procedures and exploit a SQL injection point in the getInventoryReportData parameter of the /NetworkServlet API endpoint. Successful exploitation can lead to remote code execution with administrator privileges.

Recommendations Update to version 5.7.04 build 6425 or later.

Fix

RCE

Missing Authentication

SQL injection

Weakness Enumeration

CWE-306

CWE-89

Related Identifiers

BDU:2025-14782

CVE-2022-50592

Affected Products

Advantech Iview

References · 8

• https://bdu.fstec.ru/vul/2025-14782 · Security Note
• https://osv.dev/vulnerability/CVE-2022-50592 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50592 · Security Note
• https://advantech.tw/support/details/firmware?id=1-HIPU-183 · Patch, Vendor Advisory
• https://t.me/cveNotify/143856 · Telegram Post
• https://vulncheck.com/advisories/advantech-iview-getinventoryreportdata-parameter-sqli-rce · Note
• https://blog.exodusintel.com/2022/03/01/advantech-iview-getinventoryreportdata-parameter-sql-injection-information-disclosure · Note
• https://tenable.com/cve/CVE-2022-50592 · Note