PT-2025-45370 · Advantech · Iview

Exodus Intelligence · Published 2022-01-13 · Updated 2025-11-24 · CVE-2022-50595

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Advantech iView versions prior to 5.7.04 build 6425

Description The software contains a flaw within its SNMP management tool that permits remote attackers to circumvent authentication procedures. This allows access to a SQL injection point within the ztp search value parameter of the /NetworkServlet API endpoint. Successful exploitation can lead to remote code execution with administrator privileges.

Recommendations Update to version 5.7.04 build 6425 or later.

Fix

RCE

Missing Authentication

SQL injection

Weakness Enumeration

CWE-306

CWE-89

Related Identifiers

BDU:2025-14781

CVE-2022-50595

Affected Products

Iview

References · 8

• https://bdu.fstec.ru/vul/2025-14781 · Security Note
• https://osv.dev/vulnerability/CVE-2022-50595 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-50595 · Security Note
• https://advantech.tw/support/details/firmware?id=1-HIPU-183 · Patch, Vendor Advisory
• https://vulncheck.com/advisories/advantech-iview-ztpsearchvalue-parameter-sqli-rce · Note
• https://blog.exodusintel.com/2022/03/01/advantech-iview-ztp_search_value-parameter-sql-injection-remote-code-execution-vulnerability · Note
• https://tenable.com/cve/CVE-2022-50595 · Note
• https://t.me/cveNotify/143849 · Telegram Post