OTPulse
FeedAboutContact

Advantech iView

Plan Patch7.5ICS-CERT ICSA-25-338-07Dec 4, 2025
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Advantech iView v5.7.05.7057 contains a SQL injection vulnerability (CWE-89) that allows unauthenticated remote attackers to disclose, modify, or delete sensitive data. The vulnerability is exploitable over the network without any user interaction or special privileges required. Successful exploitation could compromise database integrity and availability, affecting operational visibility and control.

What this means
What could happen
An attacker could extract sensitive information from iView or modify/delete data stored in the system, potentially compromising visibility into industrial processes or corrupting configuration and monitoring data.
Who's at risk
Water utilities and electric utilities using Advantech iView for SCADA monitoring and control visibility. Any organization running iView v5.7.05.7057 for industrial process visibility and data management.
How it could be exploited
An attacker could send a crafted SQL injection query over the network to iView without authentication, allowing them to read, modify, or delete data from the underlying database. The attack requires only network access to the iView service port.
Prerequisites
  • Network access to iView service port
  • No authentication required
Remotely exploitableNo authentication requiredLow complexity attackSQL injection vulnerabilityInformation disclosureData modification risk
Exploitability
Low exploit probability (EPSS 0.1%)
Affected products (1)
ProductAffected VersionsFix Status
iView: 5.7.05.70575.7.05.70575.8.1
Remediation & Mitigation
0/4
Do now
0/2
HARDENINGRestrict network access to iView to authorized management stations only; do not expose iView to the Internet or untrusted networks
WORKAROUNDIf remote access to iView is required, use a VPN with current security patches
Schedule — requires maintenance window
0/1

Patching may require device reboot — plan for process interruption

HOTFIXUpdate Advantech iView to v5.8.1 or later
Long-term hardening
0/1
HARDENINGDeploy iView behind a firewall and on a segregated network segment separate from business IT systems
View full CISA ICS-CERT advisory
↑↓ Navigate · Esc Close
API: /api/v1/advisories/c0d264c6-d7d9-40be-874c-9ef5f4061f2a