Read the docs
TI-2025-32587 Aliases CVE-2025-52459GHSA-5fcw-f94j-49qx

Advantech iView Argument Injection

Priority LOW 31CWE-88Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-88.

Summary

A vulnerability exists in Advantech iView that allows for argument injection in NetworkServlet.backupDatabase(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters can be used directly in a command without proper sanitization, allowing arbitrary arguments to be injected. This can result in information disclosure, including sensitive database credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00329 26th percentileScored 2026-11-07
Fix Fixed iView (Advantech): 5.7.05 build 7057

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdvantechiViewbefore 5.7.05 build 70575.7.05 build 7057Patch availableCNA
  • iView VendorAdvantech Affected before 5.7.05 build 7057 Fixed in 5.7.05 build 7057 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:advantech:iview:*:*:*:*:*:*:*:*——Advantech
  • cpe:2.3:a:advantech:iview:*:*:*:*:*:*:*:* Versions — — ·Advantech

Remediation

  • Fix · CNA iView (Advantech) Fixed in 5.7.05 build 7057

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Advantech iView 5.7.05 build 7057

    10 records Highest priority Priority MEDIUM 3 MEDIUM, 7 LOW

    Other records, highest priority first

    Show all 10 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-52459
  2. 2026-10-03 Alias added: GHSA-5fcw-f94j-49qx

References

Other 2

  • TI-2022-01984 Command injection in Advantech iView CVSS 3.1CRITICAL 9.8
  • TI-2025-24399 Advantech WISE-DeviceOn Server < 5.4 Hard-coded JWT Key Authentication Bypass CVSS 4.0CRITICAL 10.0
  • TI-2023-05193 Advantech R-SeeNet Unauthenticated Read/Write CVSS 3.1CRITICAL 9.8
  • TI-2016-00768 Unrestricted file upload vulnerability in the uploadImageCommon function in the… CVSS 3.0CRITICAL 9.8
  • TI-2021-04850 OS command injection in Advantech CVSS 3.1CRITICAL 9.8
  • TI-2026-55194 Advantech WISE-6610-NB Node-RED nodered_lib_apply command injection CVSS 4.0CRITICAL 9.4
See all 433 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences