Iview EUVD-2025-21079

CVSS 8.8 with High impact across Confidentiality, Integrity, and Availability indicates severe exploitability. The vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reveals: (1) Network-accessible (AV:N) - remotely exploitable without physical access; (2) Low attack complexity (AC:L) - exploitation requires no special conditions; (3) Low privileges required (PR:L) - authenticated user-level access sufficient, a realistic threat in organizations where many users have monitoring console access; (4) No user interaction (UI:N) - fully automated exploitation possible. The severity is tempered by authentication requirement (PR:L), which reduces the attack surface compared to unauthenticated RCE. However, in enterprise environments with role-based access control, user-level accounts are common, making this exploitable by insider threats or compromised user credentials. Without confirmed EPSS score, KEV status, or public POC availability from provided data, real-world exploitation probability cannot be precisely quantified, but the combination of low complexity, network accessibility, and RCE potential classifies this as a HIGH PRIORITY for patching in operational environments. The execution context (LocalService) suggests database administrator-equivalent capabilities, making this a critical finding for systems running Advantech iView in production.

A disgruntled employee or insider threat with user-level access to the Advantech iView monitoring console crafts a malicious request to the NetworkServlet.archiveTrapRange() endpoint. The attacker injects SQL code into one of the method's input parameters (e.g., trap range identifier, date range filter) designed to break out of the intended query context. Example: instead of providing a legitimate trap ID, they submit: '1'; DROP TABLE traps; --' or '1' UNION SELECT system_user,user_name,password_hash FROM users--'. The unvalidated parameter is concatenated directly into an SQL query executed by the iView application under LocalService account context. The injected SQL either extracts sensitive data (credentials, configuration, network topology) or modifies/deletes records. If the underlying database supports extended stored procedures (e.g., SQL Server's xp_cmdshell), the attacker escalates to RCE by executing system commands, such as creating a reverse shell or adding backdoor accounts. Result: Complete compromise of the monitoring system, potential lateral movement to monitored network infrastructure, and persistence through code execution. No POC availability confirmed from provided data, but exploitation difficulty is LOW (AC:L) due to SQL injection's straightforward nature. Detection is possible via anomalous SQL queries in audit logs, HTTP request patterns to /archiveTrapRange endpoints, or unusual LocalService process execution (e.g., spawning cmd.exe or powershell.exe).