CVE-2025-53475
Published: 11 July 2025
Summary
CVE-2025-53475 is a high-severity SQL Injection (CWE-89) vulnerability in Advantech Iview. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 16.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
A vulnerability in Advantech iView permits SQL injection and remote code execution via the NetworkServlet.getNextTrapPage() function. The flaw stems from insufficient sanitization of certain parameters, which an attacker can abuse to inject SQL statements and achieve code execution. The affected component runs under the context of the nt authority\local service account, and the issue is tracked as CWE-89 with a CVSS 4.0 score of 8.7.
An authenticated attacker possessing at least user-level privileges can exploit the weakness over the network. Successful exploitation allows the attacker to read or modify database contents and execute arbitrary code on the server, potentially leading to full compromise of the affected iView instance.
Vendor firmware updates addressing the issue are available from Advantech, and CISA has published an ICS advisory (ICSA-25-191-08) that includes mitigation guidance. The associated EPSS score has remained flat at 0.0184 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-21080
Vulnerability details
A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through NetworkServlet.getNextTrapPage(). This issue requires an authenticated attacker with at least user-level privileges. Certain parameters in this function are not properly sanitized, allowing an…
more
attacker to perform SQL injection and potentially execute code in the context of the 'nt authority\local service' account.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing web app (NetworkServlet) directly enables remote exploitation (T1190); resulting RCE allows arbitrary command execution (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates SQL injection in NetworkServlet.getNextTrapPage() by enforcing input validation mechanisms to neutralize special elements in parameters.
Enables identification, reporting, and correction of the specific SQL injection and RCE flaw via patching as detailed in Advantech and CISA advisories.
Ensures receipt and implementation of security advisories for this CVE from sources like Advantech and CISA to facilitate timely flaw remediation.