CVE-2025-41442

A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulating certain input parameters, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or other malicious activities.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183	Product
https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:advantech:iview:*:*:*:*:*:*:*:*

History

23 Jul 2025, 19:20

Type	Values Removed	Values Added
CPE		cpe:2.3:a:advantech:iview::::::::
References	~~() https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183 -~~	() https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183 - Product
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08 - Third Party Advisory, US Government Resource
First Time		Advantech Advantech iview

11 Jul 2025, 18:15

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad en las versiones de Advantech iView anteriores a la 5.7.05, compilación 7057, que podría permitir un ataque de cross-site scripting (XSS) reflejado. Al manipular ciertos parámetros de entrada, un atacante podría ejecutar secuencias de comandos no autorizadas en el navegador del usuario, lo que podría provocar la divulgación de información u otras actividades maliciosas.

11 Jul 2025, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-11 00:15

Updated : 2025-07-23 19:20

NVD link : CVE-2025-41442

Mitre link : CVE-2025-41442

CVE.ORG link : CVE-2025-41442

JSON object : View

Products Affected

advantech

iview

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-41442", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-07-11T00:15:24.347", "references": [{"url": "https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183", "tags": ["Product"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-79"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in Advantech iView versions prior to 5.7.05 build\n 7057, which could allow a reflected cross-site scripting (XSS) attack. \nBy manipulating certain input parameters, an attacker could execute \nunauthorized scripts in the user's browser, potentially leading to \ninformation disclosure or other malicious activities."}, {"lang": "es", "value": "Existe una vulnerabilidad en las versiones de Advantech iView anteriores a la 5.7.05, compilaci\u00f3n 7057, que podr\u00eda permitir un ataque de cross-site scripting (XSS) reflejado. Al manipular ciertos par\u00e1metros de entrada, un atacante podr\u00eda ejecutar secuencias de comandos no autorizadas en el navegador del usuario, lo que podr\u00eda provocar la divulgaci\u00f3n de informaci\u00f3n u otras actividades maliciosas."}], "lastModified": "2025-07-23T19:20:42.243", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:advantech:iview:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D3E520F-CCCE-46E1-A8ED-95E10597DF43", "versionEndExcluding": "5.7.05.7057"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}