Iview EUVD-2025-21082

CVSS 7.6 (High) indicates significant risk with network-accessible attack vector (AV:N), low complexity (AC:L), and authentication required (PR:L). The privilege requirement (user-level) narrows the attacker pool but remains concerning in multi-user deployments. The vector shows high confidentiality impact (C:H), low integrity impact (I:L), and low availability impact (A:L), validating information disclosure as the primary threat. Without explicit EPSS, KEV status, or public POC confirmation in provided data, real-world exploitation probability cannot be definitively assessed, but the combination of: (1) authentication requirement limiting opportunistic exploitation, (2) presence of an intentional (but flawed) security function suggesting security-conscious design, and (3) the specific targeting of an industrial vendor suggests this may be exploited in targeted campaigns rather than mass exploitation. However, the HIGH CVSS score combined with LOW attack complexity and HIGH confidentiality impact makes this a legitimate priority for any organization running iView, particularly those handling sensitive manufacturing or operational data. This is not a low-risk-high-CVSS issue—the attack surface is real and the impact is material.

An authenticated user with standard credentials (obtained through credential theft, insider threat, or compromised account) logs into Advantech iView. Rather than using the application normally, the attacker injects malicious SQL code into a form field, API parameter, or search function. Because CUtils.checkSQLInjection() contains a bypass, the malicious SQL passes validation and is executed against the backend database. The attacker exfiltrates sensitive data (production metrics, configuration parameters, user credentials stored in database) or executes a resource-intensive query causing denial of service. For example: Input like '; DROP TABLE users; -- or ' OR '1'='1 in a search field bypasses the flawed validation function. No public POC is confirmed in provided data, but the straightforward nature of SQL injection (AC:L) suggests exploitation difficulty is low for an attacker with basic SQL knowledge and valid credentials. In industrial settings, this could compromise plant-level operational data or control system parameters.