CVE-2020-14505: Advantech iView NetworkServlet restoreDatabase Command Injection Remote Code Execution Vulnerability
Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection”) vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that creates a command string without any validation. The attacker may then remotely execute code.
Other sources
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the restoreDatabase method of the NetworkServlet class. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of SYSTEM.
— ZDI
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-14505?
CVE-2020-14505 is a vulnerability that allows remote attackers to execute arbitrary code on affected installations of Advantech iView.
Is authentication required to exploit CVE-2020-14505?
No, authentication is not required to exploit this vulnerability.
What is the severity of CVE-2020-14505?
The severity of CVE-2020-14505 is critical with a CVSS score of 9.8.
How does CVE-2020-14505 work?
CVE-2020-14505 works by exploiting a command injection vulnerability in the restoreDatabase method of the NetworkServlet class in Advantech iView.
How can CVE-2020-14505 be fixed?
To fix CVE-2020-14505, it is recommended to apply the latest security patches provided by Advantech.