What is the CVSS score of EUVD-2025-21079?

EUVD-2025-21079 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Iview are affected by EUVD-2025-21079?

Advantech iView contains a SQL injection vulnerability (CVE-2025-52577, CVSS 8.8) in its NetworkServlet component that allows authenticated users to execute arbitrary SQL commands and potentially…. A patch is available.

How to fix or mitigate EUVD-2025-21079?

Within 24 hours: Identify all Advantech iView deployments and document current versions; assess which systems are internet-accessible or accessible to untrusted network segments. Within 7 days: Apply vendor-released patch to all Advantech iView instances; verify patch application through version confirmation. Within 30 days: Conduct access review of iView user accounts and implement principle of least privilege for administrative credentials; review network segmentation to restrict iView access to authorized administrators only.

Iview EUVD-2025-21079

| CVE-2025-52577 HIGH

SQL Injection (CWE-89)

2025-07-11 ics-cert@hq.dhs.gov

RCE SQLi Iview

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:27 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

5.7.05

EUVD ID Assigned

Mar 16, 2026 - 08:17 euvd

EUVD-2025-21079

Analysis Generated

Mar 16, 2026 - 08:17 vuln.today

CVE Published

Jul 11, 2025 - 00:15 nvd

HIGH 8.8

DescriptionCVE.org

A vulnerability exists in Advantech iView that could allow SQL injection and remote code execution through NetworkServlet.archiveTrapRange(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not properly sanitized, allowing an attacker to perform SQL injection and potentially execute code in the context of the 'nt authority\local service' account.

AnalysisAI

CVE-2025-52577 is a SQL injection vulnerability in Advantech iView's NetworkServlet.archiveTrapRange() method that allows authenticated users to execute arbitrary SQL queries and potentially achieve remote code execution (RCE) within the LocalService account context. The vulnerability affects Advantech iView and requires user-level authentication, making it a post-authentication attack vector with high severity (CVSS 8.8). While no public POC or KEV status confirmation is available in provided data, the combination of SQL injection leading to RCE on a privileged service account represents significant risk for organizations deploying this network management solution.

Technical ContextAI

CVE-2025-52577 targets Advantech iView, a network management and monitoring platform commonly used in industrial and enterprise environments. The vulnerability exists in the NetworkServlet component, specifically the archiveTrapRange() method, which handles SNMP trap archival operations. The root cause is classified under CWE-89 (SQL Injection), indicating insufficient input validation/sanitization on parameters passed to SQL queries. This is a classic SQL injection flaw where attacker-controlled input from method parameters is concatenated directly into SQL commands without parameterized query preparation. The execution context of 'nt authority\local service' (Windows LocalService account) is particularly critical, as this system account typically has database-level permissions and potential access to system resources, elevating SQL injection to potential RCE through database-specific functions (e.g., xp_cmdshell in SQL Server, INTO OUTFILE in MySQL, or similar mechanisms).

RemediationAI

Immediate actions: (1) Apply Advantech security patches when released - monitor Advantech security advisories and product bulletins for CVE-2025-52577 specific guidance; (2) Implement network-level access controls restricting NetworkServlet endpoints to authorized administrators only, using firewall rules or WAF policies; (3) Review and restrict user-level account permissions within iView to principle of least privilege - disable monitoring console access for non-essential accounts; (4) Enable SQL query logging and audit trails to detect SQL injection attempts; (5) Run iView application pool/service with minimal required privileges (elevate from LocalService if possible to a restricted service account); (6) Apply input validation/whitelist controls at network perimeter via IDS/IPS signatures targeting SQL injection patterns in HTTP requests to iView. Long-term: Upgrade to patched Advantech iView release when available. Implement parameterized query execution (prepared statements) and input sanitization across all database interactions in NetworkServlet. Consult official Advantech security advisory and patch release notes for specific version numbers and rollout procedures.