Advantech iView

🗓️ 28 Jun 2022 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 181 Views

Advantech iView management software has multiple vulnerabilities including SQL Injection, Missing Authentication, and Path Traversal, which could allow unauthorized access to sensitive data and execute arbitrary code

Reporter	Title	Published	Views	Family All 139
0day.today	Advantech iView NetworkServlet Command Injection Exploit	19 Aug 202200:00	–	zdt
BDU FSTEC	The vulnerability of the `getUserPrefMenuFragment` component of the Advantech iView network device and port management system allows a malicious individual to gain unauthorized access to protected information or execute arbitrary code.	16 Jan 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the setTaskEditorItem component in the centralized network device and port management system Advantech iView allows a perpetrator to gain unauthorized access to protected information.	16 Jan 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the centralized control system for network devices and ports of Advantech iView, related to the absence of authentication procedures, allows a perpetrator to execute arbitrary codes or cause service failures.	13 Feb 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the centralized control system for network devices and ports of Advantech iView, related to the lack of measures taken to protect the SQL query structure, allows attackers to execute arbitrary SQL commands.	15 Feb 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the centralized control system for network devices and ports of Advantech iView arises from the lack of protective measures for the SQL query structure, allowing attackers to disclose protected information.	15 Feb 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the centralized control system for network devices and ports of Advantech iView arises from the lack of protective measures for the SQL query structure, allowing attackers to disclose protected information.	6 Mar 202300:00	–	bdu_fstec
Circl	CVE-2022-2135	22 Jul 202218:19	–	circl
Circl	CVE-2022-2136	22 Jul 202218:19	–	circl
Circl	CVE-2022-2137	22 Jul 202218:19	–	circl

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2022/icsa-22-179-03.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-22-179-03
cisa	www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
cisa	www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
cisa	www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

28 Jun 2022 00:00Current

8.7High risk

Vulners AI Score8.7

CVSS 3.19.8

EPSS0.58306

SSVC