CVE-2022-50591: Advantech iView < v5.7.04 Build 6425 ztp_config_id Parameter SQL Injection Information Disclosure
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘ztpconfigid’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for the exfiltration of user data, included clear text passwords.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-50591?
CVE-2022-50591 is classified as a critical vulnerability due to its potential for remote exploitation and data compromise.
How do I fix CVE-2022-50591?
To mitigate CVE-2022-50591, upgrade to Advantech iView version 5.7.04 build 6425 or later.
What kind of attacks can exploit CVE-2022-50591?
CVE-2022-50591 can be exploited through SQL injection attacks following unauthorized access via SNMP management tool vulnerability.
Which versions of Advantech iView are affected by CVE-2022-50591?
Advantech iView versions prior to v5.7.04 build 6425 are affected by CVE-2022-50591.
What impact does CVE-2022-50591 have on systems?
CVE-2022-50591 can lead to unauthorized data access and compromise of the affected system's integrity.