What is the CVSS score of CVE-2025-53475?

CVE-2025-53475 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.9%.

How to fix or mitigate CVE-2025-53475?

Within 24 hours: identify all Advantech iView deployments and current versions in your environment. Within 7 days: apply the vendor-released patch to all iView instances and validate successful deployment in a test environment first. Within 30 days: implement network segmentation to restrict iView access to authorized users only, review user account privileges with LOCAL SERVICE scope, and verify SQL query logging is enabled for post-incident forensics.

Iview CVE-2025-53475

Q: Which versions of Iview are affected by CVE-2025-53475?

Advantech iView contains a SQL injection vulnerability (CVE-2025-53475) that allows authenticated users to execute arbitrary SQL queries and potentially achieve remote code execution with LOCAL…. A patch is available.

EUVD-2025-21080 HIGH

SQL Injection (CWE-89)

2025-07-11 ics-cert@hq.dhs.gov

RCE SQLi Iview

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:27 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

5.7.05

EUVD ID Assigned

Mar 16, 2026 - 08:17 euvd

EUVD-2025-21080

Analysis Generated

Mar 16, 2026 - 08:17 vuln.today

CVE Published

Jul 11, 2025 - 00:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through NetworkServlet.getNextTrapPage(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters in this function are not properly sanitized, allowing an attacker to perform SQL injection and potentially execute code in the context of the 'nt authority\local service' account.

AnalysisAI

CVE-2025-53475 is a SQL injection vulnerability in Advantech iView's NetworkServlet.getNextTrapPage() function that allows authenticated users to execute arbitrary SQL queries and potentially achieve remote code execution within the context of the 'nt authority\local service' account. The vulnerability requires valid user-level credentials but has a high CVSS score of 8.8 due to the combination of high confidentiality, integrity, and availability impact. No KEV or active exploitation data is provided, but the authenticated requirement and network accessibility make this a moderate-to-high priority for organizations deploying Advantech iView.

Technical ContextAI

This vulnerability exists in Advantech iView, a network management and monitoring platform. The flaw is rooted in CWE-89 (SQL Injection), specifically in the NetworkServlet.getNextTrapPage() method where user-supplied parameters are not properly sanitized before being incorporated into SQL queries. Advantech iView likely uses a web-based servlet architecture (Java-based) to handle SNMP trap management and network event processing. The lack of parameterized queries or input validation allows attackers to break out of intended SQL context and inject malicious SQL commands. Successful exploitation could lead to database manipulation, unauthorized data access, or code execution via SQL extended stored procedures or database-level command execution features. The execution context ('nt authority\local service') indicates a Windows-based deployment, suggesting the backend database is likely SQL Server or similar Windows-native database service.

RemediationAI

Apply security patch from Advantech for CVE-2025-53475 when available (specific patch version not provided; contact Advantech support or monitor https://www.advantech.com/support for advisory). 2. If immediate patching is not possible, implement network-level access controls to restrict access to iView's NetworkServlet endpoints to trusted administrative networks only. 3. Apply principle of least privilege: limit user accounts with iView access to only those requiring it; avoid shared/generic accounts. 4. Monitor database query logs for anomalous SQL patterns indicating injection attempts. 5. Implement Web Application Firewall (WAF) rules to detect and block common SQL injection payloads in NetworkServlet parameters. 6. Consider disabling or restricting the getNextTrapPage() function if trap management is not actively used. 7. Upgrade to the patched version once available and thoroughly test in a non-production environment before production deployment.