CVE-2022-50593 - Advantech iView < v5.7.04 Build 6425 search_term Parameter SQL Injection RCE

Back Back to CVE browser

CRITICAL

Advantech iView < v5.7.04 Build 6425 search_term Parameter SQL Injection RCE

Published Nov 6, 2025

9.3

CRITICAL

CVSS 4.0

EPSS 0.69%

Description

Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘search_term’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for remote code execution with administrator privileges.

Affected products

Vendor Advantech Product iView Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <5.7.04 build 6425

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Advantech

iView

unaffected

Version	Status	Constraints
0	affected	<5.7.04 build 6425

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-306

Missing Authentication

CWE-89

SQL Injection

References (4)

https://blog.exodusintel.com/2022/03/01/advantech-iview-search_term-parameter-sql-injection-remote-code-execution-vulnerability/
technical-descriptionThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-38182
Advisory
https://www.advantech.tw/support/details/firmware?id=1-HIPU-183
release-notespatchProduct
https://www.vulncheck.com/advisories/advantech-iview-searchterm-parameter-sqli-rce
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://blog.exodusintel.com/2022/03/01/advantech-iview-search_term-parameter-sql-injection-remote-code-execution-vulnerability/		technical-descriptionThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-38182		Advisory
https://www.advantech.tw/support/details/firmware?id=1-HIPU-183		release-notespatchProduct
https://www.vulncheck.com/advisories/advantech-iview-searchterm-parameter-sqli-rce		third-party-advisoryThird Party Advisory