CVE-2025-53515: Advantech iView SQL Injection
A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution through NetworkServlet.archiveTrap(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not sanitized, allowing an attacker to perform SQL injection and potentially execute code in the context of the 'nt authority\local service' account.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53515?
CVE-2025-53515 is rated as a critical vulnerability due to its capability for SQL injection and remote code execution.
How do I fix CVE-2025-53515?
To remediate CVE-2025-53515, update Advantech iView to version 5.7.05 build 7057 or later.
Who is affected by CVE-2025-53515?
CVE-2025-53515 affects users of Advantech iView versions prior to 5.7.05 build 7057.
What type of attack does CVE-2025-53515 facilitate?
CVE-2025-53515 facilitates SQL injection and remote code execution attacks if exploited.
Do I need to be authenticated to exploit CVE-2025-53515?
Yes, an attacker must be authenticated with at least user-level privileges to exploit CVE-2025-53515.