CVE-2025-53509

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-53509
A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase(). This issue requires an authenticated attacker with at least user-level privileges. An input parameter can be used directly in a command without proper sanitization, allowing arbitrary arguments to be injected. This can result in information disclosure, including sensitive database credentials.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183 Product
https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

cpe:2.3:a:advantech:iview:*:*:*:*:*:*:*:*
History

01 Aug 2025, 19:16

Type Values Removed Values Added
CPE cpe:2.3:a:advantech:iview:*:*:*:*:*:*:*:*
First Time Advantech
Advantech iview
References () https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183 - () https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183 - Product
References () https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08 - () https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08 - Third Party Advisory, US Government Resource

15 Jul 2025, 13:14

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad en Advantech iView que permite la inyección de argumentos en NetworkServlet.restoreDatabase(). Este problema requiere un atacante autenticado con al menos privilegios de usuario. Un parámetro de entrada puede usarse directamente en un comando sin la debida limpieza, lo que permite la inyección de argumentos arbitrarios. Esto puede resultar en la divulgación de información, incluyendo credenciales confidenciales de la base de datos.

11 Jul 2025, 00:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-11 00:15

Updated : 2025-08-01 19:16

NVD link : CVE-2025-53509

Mitre link : CVE-2025-53509

CVE.ORG link : CVE-2025-53509

JSON object : View

Products Affected

advantech

  • iview
CWE
CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')