CVE-2025-13373CWE-89sql-injection

CVE-2025-13373

High · published December 5, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
37.4
In the wild
Unconfirmed
What it is

⚡ A single unsanitized SNMP v1 trap request could let attackers execute SQL commands directly! 😱 Think of it like a restaurant accepting any order without checking the menu—a rogue chef could sneak in a wild dish that's not even on the list! 🍽️ This vulnerability could allow an attacker to gain unauthorized access to your database, read sensitive information, manipulate data, or even take down your system entirely. The consequences could be absolutely devastating! 🥵

Put simply

Think of it like a restaurant accepting any order without checking the menu—a rogue chef could sneak in a wild dish that's not even on the list! 🍽️ CVE-2025-13373 affects Advantech iView versions 5.7.05.7057 and prior, allowing attackers to inject SQL commands through improperly sanitized SNMP v1 trap requests on Port 162. This means that malicious inputs can directly interact with the database without any restrictions!

What to do

This vulnerability could allow an attacker to gain unauthorized access to your database, read sensitive information, manipulate data, or even take down your system entirely. The consequences could be absolutely devastating! 🥵 Immediately update to a patched version of Advantech iView to ensure proper input sanitization. Additionally, review your SNMP trap configurations to filter out any unexpected requests that could exploit this flaw. Stay vigilant! 🔒 You've got this! With these steps, you'll be locking down your system in no time. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00443 · 37.4th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-12-05T04:15Z
References (3)
EPSS history
Timeline
  • 04 DEC 22:50Z
    Advantech iView SQL Injection
    cvelistv5