EUVD-2025-21080CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through NetworkServlet.getNextTrapPage(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters in this function are not properly sanitized, allowing an attacker to perform SQL injection and potentially execute code in the context of the 'nt authority\local service' account.
Analysis
CVE-2025-53475 is a SQL injection vulnerability in Advantech iView's NetworkServlet.getNextTrapPage() function that allows authenticated users to execute arbitrary SQL queries and potentially achieve remote code execution within the context of the 'nt authority\local service' account. The vulnerability requires valid user-level credentials but has a high CVSS score of 8.8 due to the combination of high confidentiality, integrity, and availability impact. No KEV or active exploitation data is provided, but the authenticated requirement and network accessibility make this a moderate-to-high priority for organizations deploying Advantech iView.
Technical Context
This vulnerability exists in Advantech iView, a network management and monitoring platform. The flaw is rooted in CWE-89 (SQL Injection), specifically in the NetworkServlet.getNextTrapPage() method where user-supplied parameters are not properly sanitized before being incorporated into SQL queries. Advantech iView likely uses a web-based servlet architecture (Java-based) to handle SNMP trap management and network event processing. The lack of parameterized queries or input validation allows attackers to break out of intended SQL context and inject malicious SQL commands. Successful exploitation could lead to database manipulation, unauthorized data access, or code execution via SQL extended stored procedures or database-level command execution features. The execution context ('nt authority\local service') indicates a Windows-based deployment, suggesting the backend database is likely SQL Server or similar Windows-native database service.
Affected Products
Advantech iView (specific version range not provided in description; typical affected range may span multiple recent versions). CPE data not explicitly provided in input, but expected CPE would be approximately: cpe:2.3:a:advantech:iview:*:*:*:*:*:*:*:* (specific version bounds to be confirmed via Advantech security advisory). Affected installations are those running Advantech iView with network trap monitoring enabled, particularly Windows deployments running the platform with SQL Server backend. Vendor should be contacted or advisory consulted for exact version ranges requiring patching.
Remediation
1. Apply security patch from Advantech for CVE-2025-53475 when available (specific patch version not provided; contact Advantech support or monitor https://www.advantech.com/support for advisory). 2. If immediate patching is not possible, implement network-level access controls to restrict access to iView's NetworkServlet endpoints to trusted administrative networks only. 3. Apply principle of least privilege: limit user accounts with iView access to only those requiring it; avoid shared/generic accounts. 4. Monitor database query logs for anomalous SQL patterns indicating injection attempts. 5. Implement Web Application Firewall (WAF) rules to detect and block common SQL injection payloads in NetworkServlet parameters. 6. Consider disabling or restricting the getNextTrapPage() function if trap management is not actively used. 7. Upgrade to the patched version once available and thoroughly test in a non-production environment before production deployment.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today