EUVD-2025-21080Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 8.8 (High) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates significant real-world risk: Network-accessible, low attack complexity, low privileges required (authenticated user), and high impact across confidentiality, integrity, and availability. The authenticated requirement (PR:L) is the primary limiting factor, reducing exploitability compared to unauthenticated SQL injection flaws. However, in many organizations, user-level access is widely distributed, making this a practical attack surface. Without explicit EPSS, KEV status, or POC availability data provided, real-world exploitation probability cannot be definitively assessed, but the combination of network accessibility, low complexity, and high impact suggests this is a legitimate priority. Organizations with many iView users or where user credentials are weak/shared should treat this as critical. Those with tightly controlled iView access and strong authentication may deprioritize relative to unauthenticated flaws. |
| Exploit ScenarioDerived | A disgruntled employee with valid iView user credentials (user-level access) navigates to or crafts a request to the NetworkServlet.getNextTrapPage() endpoint, injecting a malicious SQL payload into an unsanitized parameter—for example, adding SQL UNION queries to extract sensitive data from the underlying database or using xp_cmdshell or similar stored procedures to execute arbitrary Windows commands. The injected SQL executes with the privileges of the iView application service account ('nt authority\local service'), allowing the attacker to dump configuration data, credentials stored in the iView database, or execute system commands to pivot within the network. No user interaction is required (UI:N), and the attack is straightforward to construct (AC:L), making this a practical threat in environments where user credentials are compromised or obtained through social engineering. A proof-of-concept would likely involve URL parameter manipulation or POST body injection into the affected servlet method. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
CVE-2025-53475 is a SQL injection vulnerability in Advantech iView's NetworkServlet.getNextTrapPage() function that allows authenticated users to execute arbitrary SQL queries and potentially achieve remote code execution within the context of the 'nt authority\local service' account. The vulnerability requires valid user-level credentials but has a high CVSS score of 8.8 due to the combination of high confidentiality, integrity, and availability impact. No KEV or active exploitation data is provided, but the authenticated requirement and network accessibility make this a moderate-to-high priority for organizations deploying Advantech iView.
RemediationAI
- Apply security patch from Advantech for CVE-2025-53475 when available (specific patch version not provided; contact Advantech support or monitor https://www.advantech.com/support for advisory). 2. If immediate patching is not possible, implement network-level access controls to restrict access to iView's NetworkServlet endpoints to trusted administrative networks only. 3. Apply principle of least privilege: limit user accounts with iView access to only those requiring it; avoid shared/generic accounts. 4. Monitor database query logs for anomalous SQL patterns indicating injection attempts. 5. Implement Web Application Firewall (WAF) rules to detect and block common SQL injection payloads in NetworkServlet parameters. 6. Consider disabling or restricting the getNextTrapPage() function if trap management is not actively used. 7. Upgrade to the patched version once available and thoroughly test in a non-production environment before production deployment.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability exists in Advantech iView, a network management and monitoring platform. The flaw is rooted in CWE-89 (SQL Injection), specifically in the NetworkServlet.getNextTrapPage() method where user-supplied parameters are not properly sanitized before being incorporated into SQL queries. Advantech iView likely uses a web-based servlet architecture (Java-based) to handle SNMP trap management and network event processing. The lack of parameterized queries or input validation allows attackers to break out of intended SQL context and inject malicious SQL commands. Successful exploitation could lead to database manipulation, unauthorized data access, or code execution via SQL extended stored procedures or database-level command execution features. The execution context ('nt authority\local service') indicates a Windows-based deployment, suggesting the backend database is likely SQL Server or similar Windows-native database service.
Know when Iview gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through NetworkServlet.getNextTrapPage(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters in this function are not properly sanitized, allowing an attacker to perform SQL injection and potentially execute code in the context of the 'nt authority\local service' account.
Executive ViewAI
Advantech iView contains a SQL injection vulnerability (CVE-2025-53475) that allows authenticated users to execute arbitrary SQL queries and potentially achieve remote code execution with LOCAL SERVICE privileges, affecting data confidentiality, integrity, and availability. Organizations using iView must prioritize patching to prevent insider threats and lateral movement from compromised user accounts. The 8.8 CVSS and 0.9% EPSS score indicate high severity with emerging exploitation likelihood.
Apply vendor patch. If immediate patching is not feasible: (1) restrict network access to iView to trusted IP ranges only, (2) enforce multi-factor authentication for all iView user accounts, (3) implement database activity monitoring (DAM) to detect anomalous SQL queries, (4) monitor for privilege escalation attempts from LOCAL SERVICE account, (5) disable or isolate iView if not actively required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execut
Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow a
An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. Rated high s
An SQL injection vulnerability in Advantech iView 5.7.04.6469. Rated high severity (CVSS 7.5), this vulnerability is rem
The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and
The affected product’s configuration is vulnerable due to missing authentication, which may allow an attacker to change
Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalat
Advantech iView, Versions 5.7 and prior. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable,
Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Rated critical severity (CVSS 9
Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Rated cri
Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an at
Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command
GitHub PoC
Exploit-DB