CVE-2025-59171
Published: 06 November 2025
Summary
CVE-2025-59171 is a high-severity Path Traversal (CWE-22) vulnerability in Advantech Deviceon\/Iedge. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 35.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Mobile/Edge AI; in the Privacy and Disclosure risk domain.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation and sanitization of uploaded configuration file inputs to prevent path traversal and subsequent remote code execution.
Mandates identification, reporting, and correction of the specific sanitization flaw in configuration file handling for this CVE.
Enforces restrictions on information inputs such as file types and content patterns at upload boundaries to block specially crafted configuration files.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal flaws enable arbitrary file reads (T1083), exploitation of public-facing web applications (T1190) and remote services (T1210) leading to RCE with system privileges (T1068), and denial-of-service conditions (T1499).
NVD Description
Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions.
Deeper analysisAI
CVE-2025-59171 is a path traversal vulnerability (CWE-22) stemming from insufficient sanitization of uploaded configuration files, enabling directory traversal and subsequent remote code execution with system-level permissions. Published on 2025-11-06, it carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), indicating high confidentiality impact over the network with low attack complexity and no privileges required. The vulnerability affects industrial control systems (ICS) components as detailed in CISA advisory ICSA-25-310-01.
An unauthenticated remote attacker can exploit this vulnerability by uploading a specially crafted configuration file, traversing directories to access unauthorized paths, and achieving remote code execution at the system level. Successful exploitation grants high-level access, potentially allowing data exfiltration given the elevated confidentiality impact, though integrity and availability remain unaffected per the CVSS vector.
Mitigation details are outlined in the CISA ICS advisory at https://www.cisa.gov/news-events/ics-advisories/icsa-25-310-01 and the associated CSAF document at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-310-01.json, with Advantech recommending users contact support via https://www.advantech.com/emt/contact for patches and remediation guidance.
Details
- CWE(s)
Affected Products
AI Security AnalysisAI
- AI Category
- Mobile/Edge AI
- Risk Domain
- Privacy and Disclosure
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Advantech DeviceOn/iEdge is an IoT/edge management platform supporting edge AI deployments, affected by path traversal vulnerability (CVE-2025-59171) in a device dependency allowing arbitrary file reads or authentication bypass.