PT-2025-45369 · Advantech · Iview

Exodus Intelligence · Published 2022-01-13 · Updated 2025-11-24 · CVE-2022-50594

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Advantech iView versions prior to 5.7.04 build 6425

Description The software contains a flaw in the SNMP management tool that permits remote attackers to circumvent authentication procedures and exploit a SQL injection issue. The SQL injection occurs through the data parameter of the /NetworkServlet API endpoint. Successful exploitation can lead to the unauthorized disclosure of user data, including passwords stored in plain text.

Recommendations Update to version 5.7.04 build 6425 or later.

Fix

Missing Authentication

SQL injection

Weakness Enumeration

CWE-306

CWE-89

Related Identifiers

BDU:2025-14780

CVE-2022-50594

Affected Products

Iview

References · 8

• https://bdu.fstec.ru/vul/2025-14780 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-50594 · Security Note
• https://osv.dev/vulnerability/CVE-2022-50594 · Vendor Advisory
• https://advantech.tw/support/details/firmware?id=1-HIPU-183 · Patch, Vendor Advisory
• https://tenable.com/cve/CVE-2022-50594 · Note
• https://vulncheck.com/advisories/advantech-iview-data-parameter-sqli-information-disclosure · Note
• https://blog.exodusintel.com/2022/03/01/advantech-iview-page_action_service-parameter-sql-injection-remote-code-execution-vulnerability · Note
• https://t.me/cveNotify/143848 · Telegram Post