Advantech
Monthly
Stack-based buffer overflow in Advantech ADAM-3600 can let a remote attacker with administrative credentials execute arbitrary code on the RTU. The flaw is network-reachable and requires no user interaction, but exploitation depends on prior high-privilege access to the management interface and on network reachability, which is often constrained in segmented OT deployments. No public exploit was identified at time of analysis, and active exploitation is not confirmed by CISA KEV.
Arbitrary code execution on Advantech ADAM-3600 devices is possible for remote attackers who already possess high-privilege credentials for the device's network-reachable management service. The flaw affects ADAM-3600 units exposed to the attacker's network and carries a high CVSS score, but exploitation is not pre-authentication and depends on valid administrative or operator access. No public exploit identified at time of analysis, and the risk is credible but not emergency-level because privileged credentials and network reachability are both required.
Stack-based buffer overflow in Advantech ADAM-3600's FileProcess::CheckDir path handling lets an authenticated attacker with high-privilege access supply a directory path longer than 1024 bytes and potentially achieve arbitrary code execution on the device. The flaw is network-reachable with low complexity and no user interaction once the attacker holds the required high-privilege credentials, but impact is confined to the device with no scope change. No public exploit was identified at the time of analysis, and exploitation is primarily constrained by the high-privilege authentication prerequisite.
Heap-based buffer overflow in the Advantech ADAM-3600 remote terminal unit allows a network-reachable attacker who already holds high-privilege authenticated access to the device to corrupt heap memory and potentially achieve arbitrary code execution. The CVSS 4.0 vector (AV:N/AC:H/PR:H/UI:N, high confidentiality/integrity/availability impact) and the independent CVSS 3.1 assessment agree this is a post-authentication flaw requiring privileged credentials plus non-trivial heap grooming or a specific input path, so exploitation is not a trivial pre-auth network takeover. No public exploit code or CISA KEV entry is present in the available intelligence, and exploitation has not been confirmed in the wild; exact vulnerable firmware ranges are not specified in the input and must be scoped from the Advantech security advisory.
The Advantech ADAM-3600 industrial RTU/edge controller can be crashed by a remotely delivered crafted message that triggers an assertion fault, causing a denial of service limited to availability. No authentication or user interaction is required (PR:N/UI:N), but exploitation depends on network reachability to the affected service and on a specific precondition (AT:P) for the fault to fire. No public exploit code or CISA KEV entry was identified at time of analysis.
Arbitrary file write in Advantech ADAM-3600 lets an authenticated attacker with high-privilege operator or administrator credentials and network access to the device management interface write files to arbitrary system locations, compromising device integrity and potentially that of a subsequent system. The assessed impact is integrity-only, with no confidentiality or availability impact, and a CVSS 4.0 base score of 8.2. No public exploit was identified at time of analysis, and exploitation is gated by the need for valid privileged credentials.
Advantech ADAM-3600 industrial remote terminal units expose a path traversal flaw that allows a high-privileged authenticated user to read arbitrary files from the device filesystem over the network. This is a moderate-priority issue because exploitation requires a valid high-privilege session and network reachability to the management interface, which are constrained in segmented OT deployments; no public exploit identified at time of analysis, and the vendor advisory plus a CSA alert are available.
Authenticated, high-privilege users of the Advantech ADAM-3600 industrial edge gateway can exploit a command injection flaw in the device’s command-handling functionality to execute arbitrary OS commands with root privileges, achieving full device compromise. The network-reachable flaw has a CVSS 4.0 score of 8.6 (PR:H, UI:N, AC:L) and, per the independent assessment, is not accessible to anonymous remote attackers because valid administrative credentials or a privileged session are required. No public exploit was identified at the time of analysis, and the device’s usual placement inside segmented OT/ICS networks limits exposure, although the exact vulnerable interface and affected firmware versions were not specified.
The Advantech ADAM-3600 intelligent remote I/O module exposes a proprietary management protocol in which the SafeEnhancement protection feature fails to enforce login lockout or rate limiting, so remote attackers can repeatedly guess the administrator password until it is recovered even with the hardening option turned on. Successful guessing yields high-impact confidentiality, integrity, and availability loss on the device (CVSS 3.1 base 8.2, AV:N/AC:H/PR:N/UI:N), although exploitation is gated by attack complexity: the adversary must reach the device's protocol port and correctly implement that proprietary protocol, and the outcome depends on administrator password strength and available attack time. The issue is reported by Singapore's CSA, affects ADAM-3600 units per the wildcard CPE, and has no confirmed CISA KEV listing or public exploit code - no public exploit identified at time of analysis - with no EPSS score supplied in the available intelligence.
Stack-based buffer overflow in Advantech ADAM-3600 industrial remote I/O modules lets a high-privileged authenticated attacker execute arbitrary code on the device. Reaching the flaw requires operator-level credentials and invocation of a specific feature the vendor characterizes as non-functional, so the realistic attack surface is limited to insiders or attackers who have already compromised privileged access - the network vector and low attack complexity mean no user interaction is needed once those prerequisites are met. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV data was not provided.
Authentication bypass in Advantech ADAM-3600 enables unauthenticated network attackers to abuse the password-reset mechanism and gain unauthorized access, with high confidentiality, integrity, and availability impact; CVSS 4.0 scores this 9.2, while our independent CVSS 3.1 assessment rates it high with AC:H because a specific precondition in the reset flow must be met (AT:P). No public exploit code has been identified at time of analysis, and exploitation depends on network reachability to the controller's management/reset interface; OT segmentation substantially reduces exposure. This is a high priority for affected ICS/OT environments where ADAM-3600 devices are internet-facing or reachable from compromised IT segments.
Authentication bypass in Advantech ADAM-3600 remote terminal units allows unauthenticated network attackers to bypass the proprietary protocol's authentication mechanism and potentially achieve high impact on confidentiality, integrity, and availability (CVSS 9.3; assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is remotely reachable with no credentials or user interaction, but realistic risk depends on whether the device's proprietary protocol service is exposed beyond segmented OT/field networks. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS data was not provided.
Unauthenticated remote attackers can crash the logs management service on Advantech ADAM-3600 industrial RTUs/controllers by sending crafted input that triggers a NULL pointer dereference, denying access to that service until it is restarted. The CVSS:3.1 vector indicates network-reachable, low-complexity exploitation with no privileges or user interaction required, but impact is confined to availability - no code execution, data disclosure, or integrity loss is implied by the flaw itself. No public exploit code or confirmed active exploitation was identified at time of analysis, and practical risk is primarily gated by whether the device's logs management interface is exposed beyond a segmented OT/SCADA network.
Unauthenticated remote code execution is possible against the Advantech ADAM-3600 through a stack-based buffer overflow in its login handling. The device is rated Critical (vendor CVSS 4.0 score 9.2; assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H), but reliable exploitation is constrained by high attack complexity and by whether the login service is reachable from untrusted networks. No public exploit was identified at time of analysis.
Code execution in Advantech ADAM-3600 industrial controllers can be achieved by exploiting a buffer overflow in the password verification routine, but an attacker must first hold guest-level credentials. The issue is network-reachable and high-complexity, with a CVSS 4.0 score of 7.5; our independent assessment uses CVSS 3.1 with PR:L, suggesting the real authentication barrier may be lower than the vendor vector's PR:H indicates. No public exploit identified at time of analysis.
Forged network packets sent to the Advantech ADAM-3600 remote terminal unit (RTU) can trigger arbitrary command execution at maximum (administrative/root) privilege, giving an unauthenticated remote attacker full control of the device. The flaw is rated 9.3 under CVSS 4.0 and corroborated by an independent assessment of CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H - no authentication, no user interaction, and no non-default configuration are required, so a single crafted packet against a default-configured unit is sufficient. Exploitation is bounded mainly by network reachability: these RTUs normally sit on segmented OT/SCADA networks, but any unit exposed to the internet or reachable from a compromised IT/DMZ segment is directly at risk. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; CSA Singapore (AL-2026-149) and Advantech have published advisories. This is a genuinely high-priority flaw, not a high-CVSS-but-low-real-risk case.
A privileged, authenticated attacker who can reach the Advantech ADAM-3600 firmware upgrade function can upload a forged firmware image and achieve persistent compromise of the device. The issue is rated CVSS 4.0 8.6 (HIGH) with network reachability and high confidentiality, integrity, and availability impact, but exploitation requires high privileges (PR:H); no CISA KEV entry or public exploit code is identified in the supplied data.
Code execution in Advantech ADAM-3600 can be achieved by an authenticated attacker with high privileges who supplies crafted input to the device's logs settings functionality, triggering a stack-based buffer overflow. The flaw is network-reachable but requires valid administrative or operator access and high attack complexity, so real-world risk is moderate-priority and concentrated in OT environments where the management interface is exposed or privileged credentials are compromised. No public exploit code or confirmed active exploitation was identified at time of analysis, and Advantech's security advisory should be consulted for fixed firmware.
Authenticated administrators with network reachability to the web management interface of Advantech EKI-1242EIMS and EKI-1242IEIMS devices running firmware V1.06.01 can upload firmware images that the device accepts without any cryptographic signature or certificate verification, resulting in full, persistent compromise of the platform (CWE-345; CVSS 4.0 base 8.6). The risk is genuine but access-gated: the attacker must already hold administrator-level credentials for the management interface (PR:H), so this CVE does not by itself provide a pre-authentication or privilege-escalation path, but the resulting ability to replace device firmware gives durable control over an industrial edge device that may sit on an OT/IT boundary. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways (reported in firmware V1.06.01) allows an attacker holding high-privilege management credentials to run arbitrary operating-system commands as root through crafted request parameters. Exploitation requires network reachability to the device's management plane plus valid privileged authentication (CVSS PR:H), after which a single low-complexity, no-interaction request yields full confidentiality, integrity, and availability impact on the appliance (assessed CVSS 3.1 base 8.8; vendor-published CVSS 4.0 score 8.6). Intelligence sources show no CISA KEV listing and no public exploit identified at time of analysis; the practical gate is that these OT edge devices are normally deployed on segmented industrial networks rather than internet-exposed, making management-plane reachability the limiting factor.
Session pool exhaustion in the OPC UA gateway of Advantech EKI-1242EIMS and EKI-1242IEIMS industrial switches running firmware V1.06.01 lets an unauthenticated attacker on an adjacent network segment open multiple anonymous OPC UA sessions and consume the entire server session pool, causing a complete denial of service for all legitimate OPC UA clients. The impact is availability-only (no data read or modified, other device functions unaffected) and is bounded by the adjacency requirement plus the need for the OPC UA gateway to be enabled and to accept anonymous sessions, matching the reported CVSS 7.1 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) and the independently assessed CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. There is no CISA KEV listing and no public exploit identified at time of analysis; the finding is credited to Nozomi Networks Labs.
Passive interception of the cleartext edgserver management protocol on Advantech EKI-1242EIMS and EKI-1242IEIMS devices running firmware V1.06.01 allows any observer positioned on the same network segment to recover sensitive device identity and network metadata as it traverses the wire. The vulnerability is unauthenticated and requires no user interaction (CVSS 4.0 vector AV:A/AC:L/AT:N/PR:N/UI:N), but our independent assessment scopes the real-world impact to confidentiality only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) because a purely passive observer cannot alter or disrupt device behavior - the CVSS 4.0 base score of 8.7 reflects the vector's asserted high integrity and availability impact, which is not supported by the exploitation conditions. No public exploit code and no CISA KEV listing were identified at time of analysis, and the primary limiting factor is the requirement for network adjacency (the protocol is not remotely routable).
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 expose their edgserver management protocol on TCP port 5058 without any authentication, allowing a remote unauthenticated attacker who can reach that port to invoke critical device-management functions such as network reconfiguration, reboot, reset, and firmware upgrade. The flaw is a CWE-306 missing authentication for critical function issue with CVSS 8.8 (v4.0) and an independently assessed CVSS 3.1 of 8.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the vector contains PR:N, confirming no credentials or user interaction are required. Impact is integrity and availability only - there is no confidentiality exposure - and there is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk is gated by whether the OT management segment is reachable from an untrusted network.
Unauthenticated OS command injection in the edgserver management service of Advantech EKI-1242EIMS and EKI-1242IEIMS gateways running firmware V1.06.01 lets remote attackers execute arbitrary operating-system commands with root privileges via crafted requests sent to TCP port 5058. No credentials or user interaction are required (CVSS 4.0 vector PR:N/UI:N, provider score 9.3; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact), and default configurations are affected. Exploitation is gated only by network reachability to the management port - there is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the issue is a genuine high-priority risk on any deployment where port 5058 is exposed beyond a trusted management segment.
An authenticated file-overwrite vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS (and EKI-1242IEIMS) firmware V1.06.01 allows an attacker who already holds administrative credentials on the device's web management interface to upload a crafted backup archive whose internal file names/paths are not validated, causing arbitrary files on the device filesystem to be overwritten. The result is complete loss of confidentiality, integrity and availability for the device itself (CVSS 4.0 base 8.6; independent assessment CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), making it a genuine but authentication-gated risk in a niche OT/industrial networking device rather than a pre-auth compromise path. Because exploitation requires both network reachability to the management plane and high-privilege authentication (PR:H), realistic exposure is driven by default, weak or reused admin credentials, internet- or flat-network-exposed management interfaces, and any credential compromise on the management VLAN; no public exploit code has been identified and there is no CISA KEV entry for this CVE at time of analysis.
Arbitrary Lua code execution is possible on Advantech EKI-1242EIMS and EKI-1242IEIMS industrial Modbus gateways running firmware V1.06.01, because the Modbus CSV import workflow fails to neutralize code embedded in an uploaded configuration file (CWE-94). Exploitation requires an attacker to already hold a high-privilege authenticated session on the device web management interface and to be able to reach that interface over the network, which materially limits exposure in properly segmented OT environments; no user interaction on the part of a legitimate operator is needed, only the attacker's own crafted upload. Successful exploitation yields full loss of confidentiality, integrity, and availability of the device, but no public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not listed in CISA KEV); the vulnerability was identified by Nozomi Networks Labs and a vendor security advisory has been published.
OS command injection in the web management interface of the Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways (firmware V1.06.01) lets an attacker who already holds high-privilege administrative credentials send a crafted HTTP request whose unsanitized parameters are passed into an OS command executed as root, yielding full compromise of confidentiality, integrity, and availability of the device. The attack is remote and low-complexity with no user interaction required, but it is access-gated: the CVSS 4.0 vector carries PR:H, so exploitation presupposes valid admin access to the management UI - no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). Risk is materially amplified when the web interface is reachable from untrusted networks and protected only by default or weak credentials, a common condition for field-deployed industrial gateways.
Code injection in the web management interface of Advantech EKI-1242IEIMS (and the closely related EKI-1242EIMS) industrial gateways on firmware V1.06.01 lets a remote attacker who already holds high-privilege web UI credentials execute arbitrary code on the device, including OS commands running as root. Exploitation is low-complexity once the attacker is authenticated, but the admin credential requirement (CVSS PR:H) is a hard gate that limits exposure to devices whose management interfaces are reachable and whose admin accounts have been compromised, reused, or left at weak/default values. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Advantech has published a security advisory for the issue, with Nozomi Networks Labs credited for the discovery. Risk framing: this is a genuine but access-gated risk concentrated on internet- or flat-network-exposed management interfaces rather than on segmented OT deployments.
OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial devices running firmware V1.06.01 lets a remote attacker who already holds a valid authenticated session on the management UI execute arbitrary operating system commands with root privileges through crafted request parameters. The vulnerability (CWE-78), reported by Nozomi Networks Labs, is rated 8.6 under CVSS 4.0 (our independent assessment maps it to 8.8 under CVSS 3.1, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the high PR:H value means the attacker must first authenticate - typically at administrator level - before the injection is reachable. There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven less by exploit popularity than by how broadly the device's management plane is exposed to untrusted networks.
Authenticated high-privileged users of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways running firmware V1.06.01 can execute arbitrary operating system commands as root through the device's web management interface, because crafted request parameters reach an OS command without proper neutralization (CWE-78, OS Command Injection). The vendor-assigned CVSS 4.0 score is 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), reflecting network reachability and complete compromise of the device's confidentiality, integrity and availability with no user interaction, but exploitation deliberately depends on the attacker first holding valid administrative credentials on the management UI. Reported by Nozomi Networks Labs; no public exploit code and no confirmed active exploitation were identified at time of analysis, so the realistic risk is driven by whether the web interface is exposed and how tightly administrative access is controlled.
OS command injection in the web management interface of Advantech EKI-1242IEIMS industrial gateways (firmware V1.06.01) lets a remote authenticated attacker with high privileges execute arbitrary OS commands as root. Exploitation requires a valid high-privilege session (CVSS 4.0 PR:H) and network reachability to the management interface, but then yields full device compromise (VC:H/VI:H/VA:H). No public exploit or active exploitation has been identified at time of analysis.
Cross-site request forgery in the LuCI administrative web interface of Advantech EKI-1242IEIMS running firmware V1.06.01 allows a remote, unauthenticated attacker to make an authenticated administrator's browser issue unauthorized state-changing requests, reaching privileged device management functions with high integrity and availability impact (vendor CVSS 4.0 base 8.6; independent 3.1 assessment AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). Exploitation is conditional and social-engineering dependent: the administrator must hold an active LuCI session and be lured into visiting attacker-controlled content, so the technique fails against logged-out or idle-session administrators and reliability is constrained by the required user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.
Command injection in Advantech WISE-6610 series industrial IoT gateways allows a remotely authenticated attacker with low privileges to execute arbitrary OS commands via the Node-RED Library's nodered_lib_apply function. All thirteen WISE-6610 firmware variants at version 1.2.1_20251110 are confirmed affected, and a public exploit is available. Advantech has released firmware 1.2.4_20260821 as the fix, with no active exploitation (CISA KEV) confirmed at time of analysis.
Command injection in Advantech WISE-6610 LoRaWAN gateway firmware 1.2.1_20251110 allows a remote low-privileged attacker to execute arbitrary OS commands by manipulating the act parameter in the Basic Station Certificate-Deletion Handler (basicstation_apply function). All 13 WISE-6610 hardware variants are affected, spanning NB, EB, TB, JB, CB, EL-series, and P-series models deployed in industrial IoT environments. A public proof-of-concept exploit has been disclosed; upgrading to firmware 1.2.4_20260821 resolves the issue.
Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge gateways allows an authenticated attacker to overflow a fixed-size stack buffer in the device's file-upload functionality and execute arbitrary code on the controller. The flaw affects all versions listed in the CSA advisory (AL-2026-097) and, given the device's role in OT/SCADA data acquisition, a successful exploit yields full control of an industrial edge node. No public exploit has been identified at time of analysis, and high attack complexity plus a high-privilege requirement temper the network-facing CVSS 4.0 base score of 7.5.
An unauthenticated remote attacker can trigger a stack-based buffer overflow in the Cookie parsing routines of Advantech ADAM-3600 EdgeLink firmware to achieve code execution, but only on devices where the SafeEnhancement feature is enabled. All builds prior to 2.8.5.1 are affected; the flaw is reachable over the network with no credentials and no user interaction, though the assessed Attack Complexity is High because a working exploit must corrupt the stack past platform defenses. Exploitation has not been observed (CISA SSVC exploitation: none, no KEV entry, EPSS 0.14%), and no public exploit code has been identified at time of analysis; the headline CVSS 4.0 score of 9.2 should be weighed against the non-default SafeEnhancement prerequisite, the High complexity rating, and the low exploitation likelihood signal.
Remote code execution in Advantech ADAM-3600 EdgeLink prior to 2.8.5.1 is possible through an unauthenticated stack-based buffer overflow in the device's log message handling. The CVSS 4.0 score is 9.2, but exploitation is rated high complexity and there is no public exploit identified at time of analysis; EPSS is low at 0.14% (4th percentile), and CISA SSVC lists exploitation as none. Attackers with network reach to the OT gateway's logging service could potentially corrupt stack memory and execute code, although segmented OT deployments reduce practical exposure.
Command injection in Advantech's ADAM-3600 EdgeLink firmware (versions prior to 2.8.5.1) lets an attacker with privileged access to the device management interface run arbitrary OS commands during the firmware upgrade file verification step. Because exploitation requires the high privileges needed to initiate a firmware upgrade (CVSS PR:H), this is effectively a post-authentication flaw that an attacker who already controls an administrative account could use for command execution, persistence, or to deepen foothold on the industrial edge controller; no user interaction is required. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and EPSS is low (0.14%, 4th percentile), though CISA SSVC marks the issue as automatable with total technical impact, so the absence of exploitation signals should not be read as low consequence for exposed devices.
Unauthenticated code execution in Advantech ADAM-3600 EdgeLink gateways running firmware prior to 2.8.5.1, reachable over the network through a stack-based buffer overflow in the password handling code, but only when the optional SafeEnhancement feature has been explicitly enabled. No credentials (PR:N) and no user interaction (UI:N) are required, yet exploitation is gated by that non-default feature dependency and by the high complexity of turning the overflow into reliable code execution, so devices with SafeEnhancement disabled are not exposed via this path. At the time of analysis there is no public exploit identified, CISA SSVC exploitation is rated 'none', and EPSS is low at 0.14% (4th percentile), which contrasts with the 9.2 CVSS 4.0 score and points to a serious-but-conditional flaw rather than a broadly exploited emergency.
Sensitive data exposure in Advantech Hospital Queuing Management lets unauthenticated remote attackers reach a specific URL and retrieve the application's API documentation, mapping out endpoints and parameters without any credentials. The flaw is rooted in missing authentication (CWE-306) on a resource that should be protected, and TWCERT rates it CVSS 4.0 9.3 (Critical). No public exploit is identified at time of analysis, but the exposed API documentation provides reconnaissance that materially lowers the barrier to follow-on attacks.
Information disclosure in Advantech Hospital Queuing Management allows unauthenticated remote attackers to retrieve internal API documentation by requesting a specific URL, exposing the application's API surface, endpoints, and parameters. The flaw carries a high CVSS 4.0 base score of 8.7 driven entirely by confidentiality impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The leaked documentation primarily serves as reconnaissance that lowers the barrier to attacking other endpoints of this healthcare queuing platform.
SQL injection in multiple Advantech industrial IoT platforms allows remote authenticated attackers with high privileges to execute arbitrary database commands. Affected products include WebAccess/SCADA, SaaS Composer, IoTSuite Growth/Starter, and IoT Edge across Windows and Linux Docker deployments. The vulnerability enables complete database compromise - attackers can read sensitive industrial control system data, modify configurations, or delete critical operational information. CVSS 7.2 reflects high impact across confidentiality, integrity, and availability, though exploitation requires administrative credentials (PR:H), significantly limiting attack surface compared to unauthenticated SQL injection vulnerabilities.
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 19.2%.
Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 72.2%.
Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 40.2%.
Administrator credentials for EdgeLink-enabled Advantech ADAM-3600 devices can be recovered from an encrypted project file, exposing sensitive device management secrets to anyone who obtains that engineering artifact. The issue is a moderate, conditional information-disclosure risk: exploitation requires local access and prior possession of the project file, which is normally confined to operator workstations, backups, or repositories, and there is no remote unauthenticated path. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided.
Heap memory disclosure in Advantech ADAM-3600 industrial remote terminal units lets remote attackers read beyond the bounds of allocated heap buffers and exfiltrate whatever sensitive data resides in adjacent memory. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L only) indicates the flaw is reachable over the network without authentication or user interaction against an exposed device, but impact is confined to confidentiality - no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; realistic risk is governed less by the software flaw than by whether the RTU is reachable from an untrusted network, since these OT devices are normally shielded by ICS segmentation.
Unauthenticated remote attackers can crash the bulk port configuration service on Advantech ADAM-3600 edge controllers, causing a limited denial-of-service condition with no confidentiality or integrity impact. The flaw is network-reachable and requires no user interaction, but practical risk depends on whether the device's configuration service is exposed beyond properly segmented ICS/OT networks. No public exploit code has been identified at time of analysis, and the issue is availability-only rather than remote code execution.
Denial of service in Advantech ADAM-3600's license manager service allows unauthenticated network attackers to crash the service by triggering an integer overflow. The CVSS 4.0 score of 6.9 reflects network reachability with low availability impact only-no confidentiality or integrity effect-and no public exploit code or CISA KEV entry was identified at time of analysis. Because ADAM-3600 is an industrial RTU typically placed on segmented OT/field networks, realistic exploitation depends on attacker access to a connected control network or poor segmentation.
Unauthenticated remote attackers who can reach the Advantech ADAM-3600 license manager RPC service can crash it by sending a crafted message with msglen set to 0, triggering a NULL pointer dereference in rpc_rx_fsm. The flaw affects ADAM-3600 industrial RTUs and is availability-only, with no code execution, data disclosure, or integrity impact; no public exploit identified at time of analysis. Because the device is typically deployed on segmented ICS/OT networks, exposure is usually limited, making this a medium-severity denial-of-service issue rather than a critical compromise vector.
Unauthenticated remote attackers can crash the license manager service on Advantech ADAM-3600 by sending crafted RPC messages that trigger a NULL pointer dereference in the rpc_rx_fsm function, causing an availability-only denial of service. The provided CVSS 4.0 score is 6.9, while the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, reinforcing that confidentiality and integrity are not affected. No public exploit was identified at time of analysis, and practical risk depends on whether the device's license manager RPC service is reachable from untrusted networks.
Denial of service in Advantech ADAM-3600 can be triggered by an unauthenticated remote attacker who opens and then disconnects a connection to the license manager service, invoking the on_disconnected callback and causing a NULL pointer dereference that crashes the service. The supplied CVSS 4.0 score is 6.9 (AV:N/AC:L/PR:N/UI:N/VA:L), and the independent assessment rates availability impact as Low with no confidentiality or integrity impact; this is a moderate-severity availability issue rather than a code-execution or data-access flaw. No public exploit identified at time of analysis.
Stored cross-site scripting in the Modbus transaction management interface of Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways (firmware V1.06.01) lets an attacker who already holds high-privileged authenticated access to the gateway web UI persist malicious script that later executes in the browser of any administrator who opens the affected management page. Because the payload is stored and served from the device itself, the more serious consequences land in the victim administrator's browser session (scope change to High per the CVSS:4.0 vector, and C:H/I:H/S:H in the 3.1 assessment) while impact on the gateway itself is limited to Low confidentiality and integrity, with no availability impact. Exploitation requires two compounding preconditions - pre-existing admin credentials (PR:H) and a victim administrator's subsequent page view (UI:P) - so there is no unauthenticated or zero-interaction path; no public exploit code or confirmed active exploitation was identified at time of analysis.
Critical SQL injection vulnerability in an internet-exposed service enabling unauthenticated extraction and manipulation of the entire database. CVSS 10.0 with scope change, EPSS 12.9% indicating high exploitation activity.
An unrestricted file upload flaw (CWE-434) in Advantech WebAccess/SCADA 9.2.1 lets an authenticated remote attacker with low privileges place a file on the server that is then executed, resulting in remote code execution with high impact to confidentiality, integrity, and availability of the SCADA host. Exploitation is network-reachable and low complexity with no user interaction, but it is not unauthenticated - a valid low-privilege session and a reachable file-upload function are both required. No public exploit code or confirmed active exploitation has been identified at time of analysis, and CISA ICS-CERT published advisory ICSA-25-352-06 covering the issue.
Local privilege escalation in the Advantech SUSI Windows kernel driver (susi.sys) 5.0.24335 and prior allows an authenticated low-privileged user to read and write arbitrary memory, I/O ports, and model-specific registers (MSRs), which can be leveraged to escalate to SYSTEM, execute arbitrary code in kernel context, or disclose sensitive information. Exploitation requires local code execution on a host where the driver is installed and loaded - typical of Advantech industrial/embedded PCs or any Windows system running the SUSI software - with no user interaction and no remote network vector; authentication requirements are confirmed as low-privileged (CVSS PR:L). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is real but not indicative of an emergency; note that because susi.sys is a signed third-party driver, it is additionally exposable to bring-your-own-vulnerable-driver (BYOVD) abuse on hosts where SUSI is not natively installed.
Remote authentication bypass in Advantech WISE-DeviceOn Server allows unauthenticated attackers to forge JSON Web Tokens using a static HMAC secret, gaining full administrative control and the ability to execute arbitrary code on managed agents. With a CVSS score of 10.0, the vulnerability enables impersonation of any account, including the root super admin, if the attacker can guess a valid email address. No active exploitation has been reported at time of analysis, but the nature of the flaw makes exploitation trivial.
A heap corruption vulnerability exists in the Advantech TP-3250 printer driver's DrvUI_x64_ADVANTECH.dll (v0.3.9200.20789) when DocumentPropertiesW() is called with a valid dmDriverExtra value but an. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosure or data manipulation. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories, or read/write files, within the context. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low-privileged observer user to inject SQL. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated low-privileged observer user to inject. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authenticated low-privileged observer user to. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authenticated low-privileged observer user to. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privileged observer user to. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated low-privileged observer user to inject. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged observer user to inject. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction(). Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction(). Rated medium severity (CVSS 6.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulating specific parameters, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or other malicious activities.
A remote code execution vulnerability in Advantech iView that allows for SQL injection and remote code execution (CVSS 8.8) that allows for sql injection and remote code execution. High severity vulnerability requiring prompt remediation.
A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase(). This issue requires an authenticated attacker with at least user-level privileges. An input parameter can be used directly in a command without proper sanitization, allowing arbitrary arguments to be injected. This can result in information disclosure, including sensitive database credentials.
CVE-2025-53475 is a SQL injection vulnerability in Advantech iView's NetworkServlet.getNextTrapPage() function that allows authenticated users to execute arbitrary SQL queries and potentially achieve remote code execution within the context of the 'nt authority\local service' account. The vulnerability requires valid user-level credentials but has a high CVSS score of 8.8 due to the combination of high confidentiality, integrity, and availability impact. No KEV or active exploitation data is provided, but the authenticated requirement and network accessibility make this a moderate-to-high priority for organizations deploying Advantech iView.
A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By exploiting this flaw, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or other malicious activities.
CVE-2025-52577 is a SQL injection vulnerability in Advantech iView's NetworkServlet.archiveTrapRange() method that allows authenticated users to execute arbitrary SQL queries and potentially achieve remote code execution (RCE) within the LocalService account context. The vulnerability affects Advantech iView and requires user-level authentication, making it a post-authentication attack vector with high severity (CVSS 8.8). While no public POC or KEV status confirmation is available in provided data, the combination of SQL injection leading to RCE on a privileged service account represents significant risk for organizations deploying this network management solution.
CVE-2025-48891 is a SQL injection vulnerability in Advantech iView's CUtils.checkSQLInjection() function that fails to properly sanitize user input, allowing authenticated attackers with user-level privileges to execute arbitrary SQL queries. This can lead to unauthorized information disclosure or denial-of-service conditions. The vulnerability requires network access and user authentication but has no UI interaction requirement, making it a significant risk for organizations using iView in multi-user environments.
A vulnerability exists in Advantech iView in NetworkServlet.processImportRequest() that could allow for a directory traversal attack. This issue requires an authenticated attacker with at least user-level privileges. A specific parameter is not properly sanitized or normalized, potentially allowing an attacker to determine the existence of arbitrary files on the server.
A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulating certain input parameters, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or other malicious activities.
Stack-based buffer overflow in Advantech ADAM-3600 can let a remote attacker with administrative credentials execute arbitrary code on the RTU. The flaw is network-reachable and requires no user interaction, but exploitation depends on prior high-privilege access to the management interface and on network reachability, which is often constrained in segmented OT deployments. No public exploit was identified at time of analysis, and active exploitation is not confirmed by CISA KEV.
Arbitrary code execution on Advantech ADAM-3600 devices is possible for remote attackers who already possess high-privilege credentials for the device's network-reachable management service. The flaw affects ADAM-3600 units exposed to the attacker's network and carries a high CVSS score, but exploitation is not pre-authentication and depends on valid administrative or operator access. No public exploit identified at time of analysis, and the risk is credible but not emergency-level because privileged credentials and network reachability are both required.
Stack-based buffer overflow in Advantech ADAM-3600's FileProcess::CheckDir path handling lets an authenticated attacker with high-privilege access supply a directory path longer than 1024 bytes and potentially achieve arbitrary code execution on the device. The flaw is network-reachable with low complexity and no user interaction once the attacker holds the required high-privilege credentials, but impact is confined to the device with no scope change. No public exploit was identified at the time of analysis, and exploitation is primarily constrained by the high-privilege authentication prerequisite.
Heap-based buffer overflow in the Advantech ADAM-3600 remote terminal unit allows a network-reachable attacker who already holds high-privilege authenticated access to the device to corrupt heap memory and potentially achieve arbitrary code execution. The CVSS 4.0 vector (AV:N/AC:H/PR:H/UI:N, high confidentiality/integrity/availability impact) and the independent CVSS 3.1 assessment agree this is a post-authentication flaw requiring privileged credentials plus non-trivial heap grooming or a specific input path, so exploitation is not a trivial pre-auth network takeover. No public exploit code or CISA KEV entry is present in the available intelligence, and exploitation has not been confirmed in the wild; exact vulnerable firmware ranges are not specified in the input and must be scoped from the Advantech security advisory.
The Advantech ADAM-3600 industrial RTU/edge controller can be crashed by a remotely delivered crafted message that triggers an assertion fault, causing a denial of service limited to availability. No authentication or user interaction is required (PR:N/UI:N), but exploitation depends on network reachability to the affected service and on a specific precondition (AT:P) for the fault to fire. No public exploit code or CISA KEV entry was identified at time of analysis.
Arbitrary file write in Advantech ADAM-3600 lets an authenticated attacker with high-privilege operator or administrator credentials and network access to the device management interface write files to arbitrary system locations, compromising device integrity and potentially that of a subsequent system. The assessed impact is integrity-only, with no confidentiality or availability impact, and a CVSS 4.0 base score of 8.2. No public exploit was identified at time of analysis, and exploitation is gated by the need for valid privileged credentials.
Advantech ADAM-3600 industrial remote terminal units expose a path traversal flaw that allows a high-privileged authenticated user to read arbitrary files from the device filesystem over the network. This is a moderate-priority issue because exploitation requires a valid high-privilege session and network reachability to the management interface, which are constrained in segmented OT deployments; no public exploit identified at time of analysis, and the vendor advisory plus a CSA alert are available.
Authenticated, high-privilege users of the Advantech ADAM-3600 industrial edge gateway can exploit a command injection flaw in the device’s command-handling functionality to execute arbitrary OS commands with root privileges, achieving full device compromise. The network-reachable flaw has a CVSS 4.0 score of 8.6 (PR:H, UI:N, AC:L) and, per the independent assessment, is not accessible to anonymous remote attackers because valid administrative credentials or a privileged session are required. No public exploit was identified at the time of analysis, and the device’s usual placement inside segmented OT/ICS networks limits exposure, although the exact vulnerable interface and affected firmware versions were not specified.
The Advantech ADAM-3600 intelligent remote I/O module exposes a proprietary management protocol in which the SafeEnhancement protection feature fails to enforce login lockout or rate limiting, so remote attackers can repeatedly guess the administrator password until it is recovered even with the hardening option turned on. Successful guessing yields high-impact confidentiality, integrity, and availability loss on the device (CVSS 3.1 base 8.2, AV:N/AC:H/PR:N/UI:N), although exploitation is gated by attack complexity: the adversary must reach the device's protocol port and correctly implement that proprietary protocol, and the outcome depends on administrator password strength and available attack time. The issue is reported by Singapore's CSA, affects ADAM-3600 units per the wildcard CPE, and has no confirmed CISA KEV listing or public exploit code - no public exploit identified at time of analysis - with no EPSS score supplied in the available intelligence.
Stack-based buffer overflow in Advantech ADAM-3600 industrial remote I/O modules lets a high-privileged authenticated attacker execute arbitrary code on the device. Reaching the flaw requires operator-level credentials and invocation of a specific feature the vendor characterizes as non-functional, so the realistic attack surface is limited to insiders or attackers who have already compromised privileged access - the network vector and low attack complexity mean no user interaction is needed once those prerequisites are met. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS/KEV data was not provided.
Authentication bypass in Advantech ADAM-3600 enables unauthenticated network attackers to abuse the password-reset mechanism and gain unauthorized access, with high confidentiality, integrity, and availability impact; CVSS 4.0 scores this 9.2, while our independent CVSS 3.1 assessment rates it high with AC:H because a specific precondition in the reset flow must be met (AT:P). No public exploit code has been identified at time of analysis, and exploitation depends on network reachability to the controller's management/reset interface; OT segmentation substantially reduces exposure. This is a high priority for affected ICS/OT environments where ADAM-3600 devices are internet-facing or reachable from compromised IT segments.
Authentication bypass in Advantech ADAM-3600 remote terminal units allows unauthenticated network attackers to bypass the proprietary protocol's authentication mechanism and potentially achieve high impact on confidentiality, integrity, and availability (CVSS 9.3; assessed CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is remotely reachable with no credentials or user interaction, but realistic risk depends on whether the device's proprietary protocol service is exposed beyond segmented OT/field networks. No public exploit code or CISA KEV entry was identified at time of analysis, and EPSS data was not provided.
Unauthenticated remote attackers can crash the logs management service on Advantech ADAM-3600 industrial RTUs/controllers by sending crafted input that triggers a NULL pointer dereference, denying access to that service until it is restarted. The CVSS:3.1 vector indicates network-reachable, low-complexity exploitation with no privileges or user interaction required, but impact is confined to availability - no code execution, data disclosure, or integrity loss is implied by the flaw itself. No public exploit code or confirmed active exploitation was identified at time of analysis, and practical risk is primarily gated by whether the device's logs management interface is exposed beyond a segmented OT/SCADA network.
Unauthenticated remote code execution is possible against the Advantech ADAM-3600 through a stack-based buffer overflow in its login handling. The device is rated Critical (vendor CVSS 4.0 score 9.2; assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H), but reliable exploitation is constrained by high attack complexity and by whether the login service is reachable from untrusted networks. No public exploit was identified at time of analysis.
Code execution in Advantech ADAM-3600 industrial controllers can be achieved by exploiting a buffer overflow in the password verification routine, but an attacker must first hold guest-level credentials. The issue is network-reachable and high-complexity, with a CVSS 4.0 score of 7.5; our independent assessment uses CVSS 3.1 with PR:L, suggesting the real authentication barrier may be lower than the vendor vector's PR:H indicates. No public exploit identified at time of analysis.
Forged network packets sent to the Advantech ADAM-3600 remote terminal unit (RTU) can trigger arbitrary command execution at maximum (administrative/root) privilege, giving an unauthenticated remote attacker full control of the device. The flaw is rated 9.3 under CVSS 4.0 and corroborated by an independent assessment of CVSS 3.1 AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H - no authentication, no user interaction, and no non-default configuration are required, so a single crafted packet against a default-configured unit is sufficient. Exploitation is bounded mainly by network reachability: these RTUs normally sit on segmented OT/SCADA networks, but any unit exposed to the internet or reachable from a compromised IT/DMZ segment is directly at risk. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied; CSA Singapore (AL-2026-149) and Advantech have published advisories. This is a genuinely high-priority flaw, not a high-CVSS-but-low-real-risk case.
A privileged, authenticated attacker who can reach the Advantech ADAM-3600 firmware upgrade function can upload a forged firmware image and achieve persistent compromise of the device. The issue is rated CVSS 4.0 8.6 (HIGH) with network reachability and high confidentiality, integrity, and availability impact, but exploitation requires high privileges (PR:H); no CISA KEV entry or public exploit code is identified in the supplied data.
Code execution in Advantech ADAM-3600 can be achieved by an authenticated attacker with high privileges who supplies crafted input to the device's logs settings functionality, triggering a stack-based buffer overflow. The flaw is network-reachable but requires valid administrative or operator access and high attack complexity, so real-world risk is moderate-priority and concentrated in OT environments where the management interface is exposed or privileged credentials are compromised. No public exploit code or confirmed active exploitation was identified at time of analysis, and Advantech's security advisory should be consulted for fixed firmware.
Authenticated administrators with network reachability to the web management interface of Advantech EKI-1242EIMS and EKI-1242IEIMS devices running firmware V1.06.01 can upload firmware images that the device accepts without any cryptographic signature or certificate verification, resulting in full, persistent compromise of the platform (CWE-345; CVSS 4.0 base 8.6). The risk is genuine but access-gated: the attacker must already hold administrator-level credentials for the management interface (PR:H), so this CVE does not by itself provide a pre-authentication or privilege-escalation path, but the resulting ability to replace device firmware gives durable control over an industrial edge device that may sit on an OT/IT boundary. No public exploit code or confirmed active exploitation was identified at time of analysis.
Authenticated OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways (reported in firmware V1.06.01) allows an attacker holding high-privilege management credentials to run arbitrary operating-system commands as root through crafted request parameters. Exploitation requires network reachability to the device's management plane plus valid privileged authentication (CVSS PR:H), after which a single low-complexity, no-interaction request yields full confidentiality, integrity, and availability impact on the appliance (assessed CVSS 3.1 base 8.8; vendor-published CVSS 4.0 score 8.6). Intelligence sources show no CISA KEV listing and no public exploit identified at time of analysis; the practical gate is that these OT edge devices are normally deployed on segmented industrial networks rather than internet-exposed, making management-plane reachability the limiting factor.
Session pool exhaustion in the OPC UA gateway of Advantech EKI-1242EIMS and EKI-1242IEIMS industrial switches running firmware V1.06.01 lets an unauthenticated attacker on an adjacent network segment open multiple anonymous OPC UA sessions and consume the entire server session pool, causing a complete denial of service for all legitimate OPC UA clients. The impact is availability-only (no data read or modified, other device functions unaffected) and is bounded by the adjacency requirement plus the need for the OPC UA gateway to be enabled and to accept anonymous sessions, matching the reported CVSS 7.1 (CVSS 4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) and the independently assessed CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. There is no CISA KEV listing and no public exploit identified at time of analysis; the finding is credited to Nozomi Networks Labs.
Passive interception of the cleartext edgserver management protocol on Advantech EKI-1242EIMS and EKI-1242IEIMS devices running firmware V1.06.01 allows any observer positioned on the same network segment to recover sensitive device identity and network metadata as it traverses the wire. The vulnerability is unauthenticated and requires no user interaction (CVSS 4.0 vector AV:A/AC:L/AT:N/PR:N/UI:N), but our independent assessment scopes the real-world impact to confidentiality only (CVSS 3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) because a purely passive observer cannot alter or disrupt device behavior - the CVSS 4.0 base score of 8.7 reflects the vector's asserted high integrity and availability impact, which is not supported by the exploitation conditions. No public exploit code and no CISA KEV listing were identified at time of analysis, and the primary limiting factor is the requirement for network adjacency (the protocol is not remotely routable).
Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways running firmware V1.06.01 expose their edgserver management protocol on TCP port 5058 without any authentication, allowing a remote unauthenticated attacker who can reach that port to invoke critical device-management functions such as network reconfiguration, reboot, reset, and firmware upgrade. The flaw is a CWE-306 missing authentication for critical function issue with CVSS 8.8 (v4.0) and an independently assessed CVSS 3.1 of 8.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H); the vector contains PR:N, confirming no credentials or user interaction are required. Impact is integrity and availability only - there is no confidentiality exposure - and there is no public exploit identified at time of analysis and no CISA KEV listing, so the practical risk is gated by whether the OT management segment is reachable from an untrusted network.
Unauthenticated OS command injection in the edgserver management service of Advantech EKI-1242EIMS and EKI-1242IEIMS gateways running firmware V1.06.01 lets remote attackers execute arbitrary operating-system commands with root privileges via crafted requests sent to TCP port 5058. No credentials or user interaction are required (CVSS 4.0 vector PR:N/UI:N, provider score 9.3; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact), and default configurations are affected. Exploitation is gated only by network reachability to the management port - there is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the issue is a genuine high-priority risk on any deployment where port 5058 is exposed beyond a trusted management segment.
An authenticated file-overwrite vulnerability in the backup-restore workflow of Advantech EKI-1242EIMS (and EKI-1242IEIMS) firmware V1.06.01 allows an attacker who already holds administrative credentials on the device's web management interface to upload a crafted backup archive whose internal file names/paths are not validated, causing arbitrary files on the device filesystem to be overwritten. The result is complete loss of confidentiality, integrity and availability for the device itself (CVSS 4.0 base 8.6; independent assessment CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), making it a genuine but authentication-gated risk in a niche OT/industrial networking device rather than a pre-auth compromise path. Because exploitation requires both network reachability to the management plane and high-privilege authentication (PR:H), realistic exposure is driven by default, weak or reused admin credentials, internet- or flat-network-exposed management interfaces, and any credential compromise on the management VLAN; no public exploit code has been identified and there is no CISA KEV entry for this CVE at time of analysis.
Arbitrary Lua code execution is possible on Advantech EKI-1242EIMS and EKI-1242IEIMS industrial Modbus gateways running firmware V1.06.01, because the Modbus CSV import workflow fails to neutralize code embedded in an uploaded configuration file (CWE-94). Exploitation requires an attacker to already hold a high-privilege authenticated session on the device web management interface and to be able to reach that interface over the network, which materially limits exposure in properly segmented OT environments; no user interaction on the part of a legitimate operator is needed, only the attacker's own crafted upload. Successful exploitation yields full loss of confidentiality, integrity, and availability of the device, but no public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not listed in CISA KEV); the vulnerability was identified by Nozomi Networks Labs and a vendor security advisory has been published.
OS command injection in the web management interface of the Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways (firmware V1.06.01) lets an attacker who already holds high-privilege administrative credentials send a crafted HTTP request whose unsanitized parameters are passed into an OS command executed as root, yielding full compromise of confidentiality, integrity, and availability of the device. The attack is remote and low-complexity with no user interaction required, but it is access-gated: the CVSS 4.0 vector carries PR:H, so exploitation presupposes valid admin access to the management UI - no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV). Risk is materially amplified when the web interface is reachable from untrusted networks and protected only by default or weak credentials, a common condition for field-deployed industrial gateways.
Code injection in the web management interface of Advantech EKI-1242IEIMS (and the closely related EKI-1242EIMS) industrial gateways on firmware V1.06.01 lets a remote attacker who already holds high-privilege web UI credentials execute arbitrary code on the device, including OS commands running as root. Exploitation is low-complexity once the attacker is authenticated, but the admin credential requirement (CVSS PR:H) is a hard gate that limits exposure to devices whose management interfaces are reachable and whose admin accounts have been compromised, reused, or left at weak/default values. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Advantech has published a security advisory for the issue, with Nozomi Networks Labs credited for the discovery. Risk framing: this is a genuine but access-gated risk concentrated on internet- or flat-network-exposed management interfaces rather than on segmented OT deployments.
OS command injection in the web management interface of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial devices running firmware V1.06.01 lets a remote attacker who already holds a valid authenticated session on the management UI execute arbitrary operating system commands with root privileges through crafted request parameters. The vulnerability (CWE-78), reported by Nozomi Networks Labs, is rated 8.6 under CVSS 4.0 (our independent assessment maps it to 8.8 under CVSS 3.1, AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the high PR:H value means the attacker must first authenticate - typically at administrator level - before the injection is reachable. There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven less by exploit popularity than by how broadly the device's management plane is exposed to untrusted networks.
Authenticated high-privileged users of Advantech EKI-1242IEIMS and EKI-1242EIMS industrial gateways running firmware V1.06.01 can execute arbitrary operating system commands as root through the device's web management interface, because crafted request parameters reach an OS command without proper neutralization (CWE-78, OS Command Injection). The vendor-assigned CVSS 4.0 score is 8.6 (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H), reflecting network reachability and complete compromise of the device's confidentiality, integrity and availability with no user interaction, but exploitation deliberately depends on the attacker first holding valid administrative credentials on the management UI. Reported by Nozomi Networks Labs; no public exploit code and no confirmed active exploitation were identified at time of analysis, so the realistic risk is driven by whether the web interface is exposed and how tightly administrative access is controlled.
OS command injection in the web management interface of Advantech EKI-1242IEIMS industrial gateways (firmware V1.06.01) lets a remote authenticated attacker with high privileges execute arbitrary OS commands as root. Exploitation requires a valid high-privilege session (CVSS 4.0 PR:H) and network reachability to the management interface, but then yields full device compromise (VC:H/VI:H/VA:H). No public exploit or active exploitation has been identified at time of analysis.
Cross-site request forgery in the LuCI administrative web interface of Advantech EKI-1242IEIMS running firmware V1.06.01 allows a remote, unauthenticated attacker to make an authenticated administrator's browser issue unauthorized state-changing requests, reaching privileged device management functions with high integrity and availability impact (vendor CVSS 4.0 base 8.6; independent 3.1 assessment AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). Exploitation is conditional and social-engineering dependent: the administrator must hold an active LuCI session and be lured into visiting attacker-controlled content, so the technique fails against logged-out or idle-session administrators and reliability is constrained by the required user interaction. No public exploit code or confirmed active exploitation was identified at time of analysis.
Command injection in Advantech WISE-6610 series industrial IoT gateways allows a remotely authenticated attacker with low privileges to execute arbitrary OS commands via the Node-RED Library's nodered_lib_apply function. All thirteen WISE-6610 firmware variants at version 1.2.1_20251110 are confirmed affected, and a public exploit is available. Advantech has released firmware 1.2.4_20260821 as the fix, with no active exploitation (CISA KEV) confirmed at time of analysis.
Command injection in Advantech WISE-6610 LoRaWAN gateway firmware 1.2.1_20251110 allows a remote low-privileged attacker to execute arbitrary OS commands by manipulating the act parameter in the Basic Station Certificate-Deletion Handler (basicstation_apply function). All 13 WISE-6610 hardware variants are affected, spanning NB, EB, TB, JB, CB, EL-series, and P-series models deployed in industrial IoT environments. A public proof-of-concept exploit has been disclosed; upgrading to firmware 1.2.4_20260821 resolves the issue.
Remote code execution in Advantech ADAM-3600 EdgeLink industrial edge gateways allows an authenticated attacker to overflow a fixed-size stack buffer in the device's file-upload functionality and execute arbitrary code on the controller. The flaw affects all versions listed in the CSA advisory (AL-2026-097) and, given the device's role in OT/SCADA data acquisition, a successful exploit yields full control of an industrial edge node. No public exploit has been identified at time of analysis, and high attack complexity plus a high-privilege requirement temper the network-facing CVSS 4.0 base score of 7.5.
An unauthenticated remote attacker can trigger a stack-based buffer overflow in the Cookie parsing routines of Advantech ADAM-3600 EdgeLink firmware to achieve code execution, but only on devices where the SafeEnhancement feature is enabled. All builds prior to 2.8.5.1 are affected; the flaw is reachable over the network with no credentials and no user interaction, though the assessed Attack Complexity is High because a working exploit must corrupt the stack past platform defenses. Exploitation has not been observed (CISA SSVC exploitation: none, no KEV entry, EPSS 0.14%), and no public exploit code has been identified at time of analysis; the headline CVSS 4.0 score of 9.2 should be weighed against the non-default SafeEnhancement prerequisite, the High complexity rating, and the low exploitation likelihood signal.
Remote code execution in Advantech ADAM-3600 EdgeLink prior to 2.8.5.1 is possible through an unauthenticated stack-based buffer overflow in the device's log message handling. The CVSS 4.0 score is 9.2, but exploitation is rated high complexity and there is no public exploit identified at time of analysis; EPSS is low at 0.14% (4th percentile), and CISA SSVC lists exploitation as none. Attackers with network reach to the OT gateway's logging service could potentially corrupt stack memory and execute code, although segmented OT deployments reduce practical exposure.
Command injection in Advantech's ADAM-3600 EdgeLink firmware (versions prior to 2.8.5.1) lets an attacker with privileged access to the device management interface run arbitrary OS commands during the firmware upgrade file verification step. Because exploitation requires the high privileges needed to initiate a firmware upgrade (CVSS PR:H), this is effectively a post-authentication flaw that an attacker who already controls an administrative account could use for command execution, persistence, or to deepen foothold on the industrial edge controller; no user interaction is required. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and EPSS is low (0.14%, 4th percentile), though CISA SSVC marks the issue as automatable with total technical impact, so the absence of exploitation signals should not be read as low consequence for exposed devices.
Unauthenticated code execution in Advantech ADAM-3600 EdgeLink gateways running firmware prior to 2.8.5.1, reachable over the network through a stack-based buffer overflow in the password handling code, but only when the optional SafeEnhancement feature has been explicitly enabled. No credentials (PR:N) and no user interaction (UI:N) are required, yet exploitation is gated by that non-default feature dependency and by the high complexity of turning the overflow into reliable code execution, so devices with SafeEnhancement disabled are not exposed via this path. At the time of analysis there is no public exploit identified, CISA SSVC exploitation is rated 'none', and EPSS is low at 0.14% (4th percentile), which contrasts with the 9.2 CVSS 4.0 score and points to a serious-but-conditional flaw rather than a broadly exploited emergency.
Sensitive data exposure in Advantech Hospital Queuing Management lets unauthenticated remote attackers reach a specific URL and retrieve the application's API documentation, mapping out endpoints and parameters without any credentials. The flaw is rooted in missing authentication (CWE-306) on a resource that should be protected, and TWCERT rates it CVSS 4.0 9.3 (Critical). No public exploit is identified at time of analysis, but the exposed API documentation provides reconnaissance that materially lowers the barrier to follow-on attacks.
Information disclosure in Advantech Hospital Queuing Management allows unauthenticated remote attackers to retrieve internal API documentation by requesting a specific URL, exposing the application's API surface, endpoints, and parameters. The flaw carries a high CVSS 4.0 base score of 8.7 driven entirely by confidentiality impact, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV. The leaked documentation primarily serves as reconnaissance that lowers the barrier to attacking other endpoints of this healthcare queuing platform.
SQL injection in multiple Advantech industrial IoT platforms allows remote authenticated attackers with high privileges to execute arbitrary database commands. Affected products include WebAccess/SCADA, SaaS Composer, IoTSuite Growth/Starter, and IoT Edge across Windows and Linux Docker deployments. The vulnerability enables complete database compromise - attackers can read sensitive industrial control system data, modify configurations, or delete critical operational information. CVSS 7.2 reflects high impact across confidentiality, integrity, and availability, though exploitation requires administrative credentials (PR:H), significantly limiting attack surface compared to unauthenticated SQL injection vulnerabilities.
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 19.2%.
Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 72.2%.
Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4). Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 40.2%.
Administrator credentials for EdgeLink-enabled Advantech ADAM-3600 devices can be recovered from an encrypted project file, exposing sensitive device management secrets to anyone who obtains that engineering artifact. The issue is a moderate, conditional information-disclosure risk: exploitation requires local access and prior possession of the project file, which is normally confined to operator workstations, backups, or repositories, and there is no remote unauthenticated path. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided.
Heap memory disclosure in Advantech ADAM-3600 industrial remote terminal units lets remote attackers read beyond the bounds of allocated heap buffers and exfiltrate whatever sensitive data resides in adjacent memory. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:L only) indicates the flaw is reachable over the network without authentication or user interaction against an exposed device, but impact is confined to confidentiality - no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis; realistic risk is governed less by the software flaw than by whether the RTU is reachable from an untrusted network, since these OT devices are normally shielded by ICS segmentation.
Unauthenticated remote attackers can crash the bulk port configuration service on Advantech ADAM-3600 edge controllers, causing a limited denial-of-service condition with no confidentiality or integrity impact. The flaw is network-reachable and requires no user interaction, but practical risk depends on whether the device's configuration service is exposed beyond properly segmented ICS/OT networks. No public exploit code has been identified at time of analysis, and the issue is availability-only rather than remote code execution.
Denial of service in Advantech ADAM-3600's license manager service allows unauthenticated network attackers to crash the service by triggering an integer overflow. The CVSS 4.0 score of 6.9 reflects network reachability with low availability impact only-no confidentiality or integrity effect-and no public exploit code or CISA KEV entry was identified at time of analysis. Because ADAM-3600 is an industrial RTU typically placed on segmented OT/field networks, realistic exploitation depends on attacker access to a connected control network or poor segmentation.
Unauthenticated remote attackers who can reach the Advantech ADAM-3600 license manager RPC service can crash it by sending a crafted message with msglen set to 0, triggering a NULL pointer dereference in rpc_rx_fsm. The flaw affects ADAM-3600 industrial RTUs and is availability-only, with no code execution, data disclosure, or integrity impact; no public exploit identified at time of analysis. Because the device is typically deployed on segmented ICS/OT networks, exposure is usually limited, making this a medium-severity denial-of-service issue rather than a critical compromise vector.
Unauthenticated remote attackers can crash the license manager service on Advantech ADAM-3600 by sending crafted RPC messages that trigger a NULL pointer dereference in the rpc_rx_fsm function, causing an availability-only denial of service. The provided CVSS 4.0 score is 6.9, while the assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, reinforcing that confidentiality and integrity are not affected. No public exploit was identified at time of analysis, and practical risk depends on whether the device's license manager RPC service is reachable from untrusted networks.
Denial of service in Advantech ADAM-3600 can be triggered by an unauthenticated remote attacker who opens and then disconnects a connection to the license manager service, invoking the on_disconnected callback and causing a NULL pointer dereference that crashes the service. The supplied CVSS 4.0 score is 6.9 (AV:N/AC:L/PR:N/UI:N/VA:L), and the independent assessment rates availability impact as Low with no confidentiality or integrity impact; this is a moderate-severity availability issue rather than a code-execution or data-access flaw. No public exploit identified at time of analysis.
Stored cross-site scripting in the Modbus transaction management interface of Advantech EKI-1242EIMS and EKI-1242IEIMS industrial gateways (firmware V1.06.01) lets an attacker who already holds high-privileged authenticated access to the gateway web UI persist malicious script that later executes in the browser of any administrator who opens the affected management page. Because the payload is stored and served from the device itself, the more serious consequences land in the victim administrator's browser session (scope change to High per the CVSS:4.0 vector, and C:H/I:H/S:H in the 3.1 assessment) while impact on the gateway itself is limited to Low confidentiality and integrity, with no availability impact. Exploitation requires two compounding preconditions - pre-existing admin credentials (PR:H) and a victim administrator's subsequent page view (UI:P) - so there is no unauthenticated or zero-interaction path; no public exploit code or confirmed active exploitation was identified at time of analysis.
Critical SQL injection vulnerability in an internet-exposed service enabling unauthenticated extraction and manipulation of the entire database. CVSS 10.0 with scope change, EPSS 12.9% indicating high exploitation activity.
An unrestricted file upload flaw (CWE-434) in Advantech WebAccess/SCADA 9.2.1 lets an authenticated remote attacker with low privileges place a file on the server that is then executed, resulting in remote code execution with high impact to confidentiality, integrity, and availability of the SCADA host. Exploitation is network-reachable and low complexity with no user interaction, but it is not unauthenticated - a valid low-privilege session and a reachable file-upload function are both required. No public exploit code or confirmed active exploitation has been identified at time of analysis, and CISA ICS-CERT published advisory ICSA-25-352-06 covering the issue.
Local privilege escalation in the Advantech SUSI Windows kernel driver (susi.sys) 5.0.24335 and prior allows an authenticated low-privileged user to read and write arbitrary memory, I/O ports, and model-specific registers (MSRs), which can be leveraged to escalate to SYSTEM, execute arbitrary code in kernel context, or disclose sensitive information. Exploitation requires local code execution on a host where the driver is installed and loaded - typical of Advantech industrial/embedded PCs or any Windows system running the SUSI software - with no user interaction and no remote network vector; authentication requirements are confirmed as low-privileged (CVSS PR:L). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is real but not indicative of an emergency; note that because susi.sys is a signed third-party driver, it is additionally exposable to bring-your-own-vulnerable-driver (BYOVD) abuse on hosts where SUSI is not natively installed.
Remote authentication bypass in Advantech WISE-DeviceOn Server allows unauthenticated attackers to forge JSON Web Tokens using a static HMAC secret, gaining full administrative control and the ability to execute arbitrary code on managed agents. With a CVSS score of 10.0, the vulnerability enables impersonation of any account, including the root super admin, if the attacker can guess a valid email address. No active exploitation has been reported at time of analysis, but the nature of the flaw makes exploitation trivial.
A heap corruption vulnerability exists in the Advantech TP-3250 printer driver's DrvUI_x64_ADVANTECH.dll (v0.3.9200.20789) when DocumentPropertiesW() is called with a valid dmDriverExtra value but an. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosure or data manipulation. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories, or read/write files, within the context. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low-privileged observer user to inject SQL. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated low-privileged observer user to inject. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authenticated low-privileged observer user to. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authenticated low-privileged observer user to. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privileged observer user to. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated low-privileged observer user to inject. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged observer user to inject. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction(). Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction(). Rated medium severity (CVSS 6.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulating specific parameters, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or other malicious activities.
A remote code execution vulnerability in Advantech iView that allows for SQL injection and remote code execution (CVSS 8.8) that allows for sql injection and remote code execution. High severity vulnerability requiring prompt remediation.
A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase(). This issue requires an authenticated attacker with at least user-level privileges. An input parameter can be used directly in a command without proper sanitization, allowing arbitrary arguments to be injected. This can result in information disclosure, including sensitive database credentials.
CVE-2025-53475 is a SQL injection vulnerability in Advantech iView's NetworkServlet.getNextTrapPage() function that allows authenticated users to execute arbitrary SQL queries and potentially achieve remote code execution within the context of the 'nt authority\local service' account. The vulnerability requires valid user-level credentials but has a high CVSS score of 8.8 due to the combination of high confidentiality, integrity, and availability impact. No KEV or active exploitation data is provided, but the authenticated requirement and network accessibility make this a moderate-to-high priority for organizations deploying Advantech iView.
A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By exploiting this flaw, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or other malicious activities.
CVE-2025-52577 is a SQL injection vulnerability in Advantech iView's NetworkServlet.archiveTrapRange() method that allows authenticated users to execute arbitrary SQL queries and potentially achieve remote code execution (RCE) within the LocalService account context. The vulnerability affects Advantech iView and requires user-level authentication, making it a post-authentication attack vector with high severity (CVSS 8.8). While no public POC or KEV status confirmation is available in provided data, the combination of SQL injection leading to RCE on a privileged service account represents significant risk for organizations deploying this network management solution.
CVE-2025-48891 is a SQL injection vulnerability in Advantech iView's CUtils.checkSQLInjection() function that fails to properly sanitize user input, allowing authenticated attackers with user-level privileges to execute arbitrary SQL queries. This can lead to unauthorized information disclosure or denial-of-service conditions. The vulnerability requires network access and user authentication but has no UI interaction requirement, making it a significant risk for organizations using iView in multi-user environments.
A vulnerability exists in Advantech iView in NetworkServlet.processImportRequest() that could allow for a directory traversal attack. This issue requires an authenticated attacker with at least user-level privileges. A specific parameter is not properly sanitized or normalized, potentially allowing an attacker to determine the existence of arbitrary files on the server.
A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulating certain input parameters, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or other malicious activities.