CVE-2025-53509: Advantech iView Argument Injection
A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase(). This issue requires an authenticated attacker with at least user-level privileges. An input parameter can be used directly in a command without proper sanitization, allowing arbitrary arguments to be injected. This can result in information disclosure, including sensitive database credentials.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53509?
CVE-2025-53509 is classified as a medium severity vulnerability due to its requirement for authenticated access and potential for data manipulation.
How do I fix CVE-2025-53509?
To mitigate CVE-2025-53509, upgrade Advantech iView to version 5.7.05 build 7057 or later.
What exploit vector is used in CVE-2025-53509?
CVE-2025-53509 is exploited through argument injection due to improper input sanitization in the NetworkServlet.restoreDatabase() method.
Who is affected by CVE-2025-53509?
CVE-2025-53509 affects users of Advantech iView versions prior to 5.7.05 build 7057.
What are the potential impacts of CVE-2025-53509?
The impacts of CVE-2025-53509 can include unauthorized command execution and potential data integrity issues within the application.