CVE-2025-53475CWE-89

Advantech iView SQL Injection

High · published July 10, 2025

CVSS v4.0

8.7

EPSS

Percentile

94.4

In the wild

Unconfirmed

What it is

A vulnerability exists in Advantech iView that could allow for SQL

injection and remote code execution through

NetworkServlet.getNextTrapPage(). This issue requires an authenticated

attacker with at least user-level privileges. Certain parameters in this

function are not properly sanitized, allowing an attacker to perform

SQL injection and potentially execute code in the context of the 'nt

authority\local service' account.

The record

Technical detail

CVSS v4.0: 8.7 · HIGH
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.07431 · 94.4th percentile
Weakness: CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published: 2025-07-10T23:23Z

EPSS history

Timeline