iView
by Advantech
CVEs (31)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-2143 | Cri | 0.71 | 9.8 | 0.59 | Jul 22, 2022 | The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. | ||
| CVE-2021-22652 | Cri | 0.70 | 9.8 | 0.37 | Feb 11, 2021 | Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution. | ||
| CVE-2021-22658 | Cri | 0.65 | 9.8 | 0.13 | Feb 11, 2021 | Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Administrator'. | ||
| CVE-2020-16245 | Cri | 0.64 | 9.8 | 0.08 | Aug 25, 2020 | Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code. | ||
| CVE-2020-14503 | Cri | 0.64 | 9.8 | 0.03 | Jul 15, 2020 | Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker to remotely execute arbitrary code. | ||
| CVE-2020-14501 | Cri | 0.64 | 9.8 | 0.02 | Jul 15, 2020 | Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text.… | ||
| CVE-2020-14507 | Cri | 0.64 | 9.8 | 0.05 | Jul 15, 2020 | Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code. | ||
| CVE-2020-14505 | Cri | 0.64 | 9.8 | 0.07 | Jul 15, 2020 | Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection”) vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that creates a command… | ||
| CVE-2020-14497 | Cri | 0.64 | 9.8 | 0.05 | Jul 15, 2020 | Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely… | ||
| CVE-2025-53475 | Hig | 0.58 | 8.8 | 0.04 | Jul 11, 2025 | A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through NetworkServlet.getNextTrapPage(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters in this function are not… | ||
| CVE-2023-3983 | Hig | 0.58 | 8.8 | 0.15 | Jul 31, 2023 | An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenticated remote attacker can bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform blind SQL injection. | ||
| CVE-2025-53515 | Hig | 0.57 | 8.8 | 0.01 | Jul 11, 2025 | A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution through NetworkServlet.archiveTrap(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not sanitized, allowing an … | ||
| CVE-2025-52577 | Hig | 0.57 | 8.8 | 0.01 | Jul 11, 2025 | A vulnerability exists in Advantech iView that could allow SQL injection and remote code execution through NetworkServlet.archiveTrapRange(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not properly… | ||
| CVE-2022-3323 | Hig | 0.51 | 7.5 | 0.31 | Sep 27, 2022 | An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration… | ||
| CVE-2021-22654 | Hig | 0.50 | 7.5 | 0.12 | Feb 11, 2021 | Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information. | ||
| CVE-2025-13373 | Hig | 0.49 | 7.5 | 0.00 | Dec 4, 2025 | Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could allow an attacker to inject SQL commands. | ||
| CVE-2025-48891 | Hig | 0.49 | 7.6 | 0.00 | Jul 11, 2025 | A vulnerability exists in Advantech iView that could allow for SQL injection through the CUtils.checkSQLInjection() function. This vulnerability can be exploited by an authenticated attacker with at least user-level privileges, potentially leading to information disclosure… | ||
| CVE-2023-52335 | Hig | 0.49 | 7.5 | 0.01 | Nov 22, 2024 | Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The… | ||
| CVE-2021-22656 | Hig | 0.49 | 7.5 | 0.03 | Feb 11, 2021 | Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files. | ||
| CVE-2020-14499 | Hig | 0.49 | 7.5 | 0.02 | Jul 15, 2020 | Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to obtain all user accounts credentials. |
- risk 0.71cvss 9.8epss 0.59
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.
- risk 0.70cvss 9.8epss 0.37
Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution.
- risk 0.65cvss 9.8epss 0.13
Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Administrator'.
- risk 0.64cvss 9.8epss 0.08
Advantech iView, Versions 5.7 and prior. The affected product is vulnerable to path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code.
- risk 0.64cvss 9.8epss 0.03
Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an attacker to remotely execute arbitrary code.
- risk 0.64cvss 9.8epss 0.02
Advantech iView, versions 5.6 and prior, has an improper authentication for critical function (CWE-306) issue. Successful exploitation of this vulnerability may allow an attacker to obtain the information of the user table, including the administrator credentials in plain text.…
- risk 0.64cvss 9.8epss 0.05
Advantech iView, versions 5.6 and prior, is vulnerable to multiple path traversal vulnerabilities that could allow an attacker to create/download arbitrary files, limit system availability, and remotely execute code.
- risk 0.64cvss 9.8epss 0.07
Advantech iView, versions 5.6 and prior, has an improper neutralization of special elements used in a command (“command injection”) vulnerability. Successful exploitation of this vulnerability may allow an attacker to send a HTTP GET or POST request that creates a command…
- risk 0.64cvss 9.8epss 0.05
Advantech iView, versions 5.6 and prior, contains multiple SQL injection vulnerabilities that are vulnerable to the use of an attacker-controlled string in the construction of SQL queries. An attacker could extract user credentials, read or modify information, and remotely…
- risk 0.58cvss 8.8epss 0.04
A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through NetworkServlet.getNextTrapPage(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters in this function are not…
- risk 0.58cvss 8.8epss 0.15
An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenticated remote attacker can bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform blind SQL injection.
- risk 0.57cvss 8.8epss 0.01
A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution through NetworkServlet.archiveTrap(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not sanitized, allowing an …
- risk 0.57cvss 8.8epss 0.01
A vulnerability exists in Advantech iView that could allow SQL injection and remote code execution through NetworkServlet.archiveTrapRange(). This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not properly…
- risk 0.51cvss 7.5epss 0.31
An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration…
- risk 0.50cvss 7.5epss 0.12
Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an unauthorized attacker to disclose information.
- risk 0.49cvss 7.5epss 0.00
Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could allow an attacker to inject SQL commands.
- risk 0.49cvss 7.6epss 0.00
A vulnerability exists in Advantech iView that could allow for SQL injection through the CUtils.checkSQLInjection() function. This vulnerability can be exploited by an authenticated attacker with at least user-level privileges, potentially leading to information disclosure…
- risk 0.49cvss 7.5epss 0.01
Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability. The…
- risk 0.49cvss 7.5epss 0.03
Advantech iView versions prior to v5.7.03.6112 are vulnerable to directory traversal, which may allow an attacker to read sensitive files.
- risk 0.49cvss 7.5epss 0.02
Advantech iView, versions 5.6 and prior, has an improper access control vulnerability. Successful exploitation of this vulnerability may allow an attacker to obtain all user accounts credentials.
Page 1 of 2