CVE-2025-52459
BaseFortify
Publication date: 2025-07-11
Last updated on: 2025-07-15
Assigner: ICS-CERT
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| advantech | iview | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-88 | The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Advantech iView's NetworkServlet.backupDatabase() function, where certain parameters are used directly in a command without proper sanitization. An authenticated attacker with at least user-level privileges can inject arbitrary arguments, leading to potential information disclosure, including sensitive database credentials.
How can this vulnerability impact me? :
The vulnerability can lead to information disclosure, specifically exposing sensitive database credentials. This could allow attackers to gain unauthorized access to database information, potentially compromising the confidentiality of data stored within the system.