CVE-2025-58423
Published: 06 November 2025
Summary
CVE-2025-58423 is a high-severity Path Traversal (CWE-22) vulnerability in Advantech Deviceon\/Iedge. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 34.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-5 (Access Restrictions for Change).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation and sanitization of information inputs such as uploaded configuration files to block path traversal, arbitrary read/write, and DoS exploits.
Restricts access to configuration change activities, preventing low-privilege remote users from uploading specially crafted configuration files.
Enforces least privilege on processes handling uploaded files to mitigate privilege escalation to local system account for arbitrary file operations.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal (CWE-22) in CVE-2025-58423, CVE-2025-62630, CVE-2025-59171 enables arbitrary file read/write/discovery as local system (T1083, facilitates T1068 priv esc); DoS condition (T1499); remote exploitation of public-facing web app (T1190).
MITRE ATLAS TechniquesAI
MITRE ATLAS techniques
NVD Description
Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories, or read/write files, within the context of the local system account.
Deeper analysisAI
CVE-2025-58423, published on 2025-11-06, is a high-severity vulnerability (CVSS 8.8, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) stemming from insufficient sanitization of uploaded configuration files, classified under CWE-22 (path traversal). It affects Advantech products as documented in CISA ICS advisory ICSA-25-310-01. An attacker can upload a specially crafted configuration file to trigger denial-of-service conditions, perform directory traversal, or read/write arbitrary files within the context of the local system account.
The attack requires low privileges (PR:L) and can be conducted remotely over the network (AV:N) with low attack complexity and no user interaction. A remote authenticated attacker with low-level access can exploit this to achieve full confidentiality, integrity, and availability impacts, including arbitrary file read/write operations executed as the local system account or causing service disruptions via DoS.
Mitigation guidance is provided in the referenced advisories. Security practitioners should consult the CISA ICS advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-25-310-01, the corresponding CSAF document at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-310-01.json, and contact Advantech support at https://www.advantech.com/emt/contact for patches or additional remediation steps.
Details
- CWE(s)