iView
by Advantech
CVEs (39)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-2143 | Cri | 0.71 | 9.8 | 0.59 | Jul 22, 2022 | The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. | ||
| CVE-2021-22652 | Cri | 0.70 | 9.8 | 0.37 | Feb 11, 2021 | Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution. | ||
| CVE-2021-22658 | Cri | 0.65 | 9.8 | 0.13 | Feb 11, 2021 | Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Administrator'. | ||
| CVE-2022-50593 | Cri | 0.64 | 9.8 | 0.01 | Nov 6, 2025 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘search_term’ parameter to the… | ||
| CVE-2022-50591 | Cri | 0.64 | 9.8 | 0.01 | Nov 6, 2025 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘ztp_config_id’ parameter to the… | ||
| CVE-2021-32930 | Cri | 0.64 | 9.8 | 0.08 | Jun 11, 2021 | The affected product’s configuration is vulnerable due to missing authentication, which may allow an attacker to change configurations and execute arbitrary code on the iView (versions prior to v5.7.03.6182). | ||
| CVE-2020-16245 | Cri | 0.64 | 9.8 | 0.08 | Aug 25, 2020 | Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code. | ||
| CVE-2020-14503 | Cri | 0.64 | 9.8 | 0.03 | Jul 15, 2020 | Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker to remotely execute arbitrary code. | ||
| CVE-2020-14501 | Cri | 0.64 | 9.8 | 0.02 | Jul 15, 2020 | Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text.… | ||
| CVE-2020-14507 | Cri | 0.64 | 9.8 | 0.05 | Jul 15, 2020 | Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code. | ||
| CVE-2020-14505 | Cri | 0.64 | 9.8 | 0.07 | Jul 15, 2020 | Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection”) vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that creates a command… | ||
| CVE-2020-14497 | Cri | 0.64 | 9.8 | 0.05 | Jul 15, 2020 | Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely… | ||
| CVE-2025-53475 | Hig | 0.58 | 8.8 | 0.05 | Jul 11, 2025 | A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through NetworkServlet.getNextTrapPage(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters in this function are not… | ||
| CVE-2023-3983 | Hig | 0.58 | 8.8 | 0.17 | Jul 31, 2023 | An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenticated remote attacker can bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform blind SQL injection. | ||
| CVE-2022-2136 | Hig | 0.58 | 8.8 | 0.09 | Jul 22, 2022 | The affected product is vulnerable to multiple SQL injections that require low privileges for exploitation and may allow an unauthorized attacker to disclose information. | ||
| CVE-2025-53515 | Hig | 0.57 | 8.8 | 0.01 | Jul 11, 2025 | A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution through NetworkServlet.archiveTrap(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not sanitized, allowing an … | ||
| CVE-2025-52577 | Hig | 0.57 | 8.8 | 0.01 | Jul 11, 2025 | A vulnerability exists in Advantech iView that could allow SQL injection and remote code execution through NetworkServlet.archiveTrapRange(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not properly… | ||
| CVE-2022-2138 | Hig | 0.54 | 8.2 | 0.11 | Jul 22, 2022 | The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute arbitrary code, resulting in a denial-of-service condition. | ||
| CVE-2022-2142 | Hig | 0.53 | 8.1 | 0.01 | Jul 22, 2022 | The affected product is vulnerable to a SQL injection with high attack complexity, which may allow an unauthorized attacker to disclose information. | ||
| CVE-2022-3323 | Hig | 0.51 | 7.5 | 0.31 | Sep 27, 2022 | An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration… |
- risk 0.71cvss 9.8epss 0.59
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.
- risk 0.70cvss 9.8epss 0.37
Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution.
- risk 0.65cvss 9.8epss 0.13
Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Administrator'.
- risk 0.64cvss 9.8epss 0.01
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘search_term’ parameter to the…
- risk 0.64cvss 9.8epss 0.01
Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘ztp_config_id’ parameter to the…
- risk 0.64cvss 9.8epss 0.08
The affected product’s configuration is vulnerable due to missing authentication, which may allow an attacker to change configurations and execute arbitrary code on the iView (versions prior to v5.7.03.6182).
- risk 0.64cvss 9.8epss 0.08
Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code.
- risk 0.64cvss 9.8epss 0.03
Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker to remotely execute arbitrary code.
- risk 0.64cvss 9.8epss 0.02
Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text.…
- risk 0.64cvss 9.8epss 0.05
Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code.
- risk 0.64cvss 9.8epss 0.07
Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection”) vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that creates a command…
- risk 0.64cvss 9.8epss 0.05
Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely…
- risk 0.58cvss 8.8epss 0.05
A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through NetworkServlet.getNextTrapPage(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters in this function are not…
- risk 0.58cvss 8.8epss 0.17
An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenticated remote attacker can bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform blind SQL injection.
- risk 0.58cvss 8.8epss 0.09
The affected product is vulnerable to multiple SQL injections that require low privileges for exploitation and may allow an unauthorized attacker to disclose information.
- risk 0.57cvss 8.8epss 0.01
A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution through NetworkServlet.archiveTrap(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not sanitized, allowing an …
- risk 0.57cvss 8.8epss 0.01
A vulnerability exists in Advantech iView that could allow SQL injection and remote code execution through NetworkServlet.archiveTrapRange(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not properly…
- risk 0.54cvss 8.2epss 0.11
The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute arbitrary code, resulting in a denial-of-service condition.
- risk 0.53cvss 8.1epss 0.01
The affected product is vulnerable to a SQL injection with high attack complexity, which may allow an unauthorized attacker to disclose information.
- risk 0.51cvss 7.5epss 0.31
An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration…
Page 1 of 2