BaseFortify

Publication date: 2025-11-06

Last updated on: 2025-11-21

Assigner: ICS-CERT

Description

Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories, or read/write files, within the context of the local system account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-06

Last Modified

2025-11-21

Generated

2026-07-06

AI Q&A

2025-11-07

EPSS Evaluated

2026-07-05

NVD

CVE-2025-58423

Affected Vendors & Products

Vendor	Product	Version / Range
advantech	deviceon\/iedge	to 2.0.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability occurs because of insufficient sanitization, allowing an attacker to upload a specially crafted configuration file. This can lead to a denial-of-service condition, directory traversal, or unauthorized reading and writing of files within the local system account context.

Impact Analysis

The vulnerability can impact you by enabling attackers to cause denial-of-service, access or modify files they should not have access to, and traverse directories on the affected system. This can compromise system availability, integrity, and confidentiality.

Hi! I’m here to help you understand CVE-2025-58423. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70