External risk intelligence

Advantech iView SQL Injection Leads to Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2022-50595

Advantech iView is a network management system typically deployed to monitor and manage industrial network infrastructure. Such systems are often configured with web-based management interfaces that are reachable over the network. Given its role as a centralized management platform, it is commonly exposed as an internal or edge-facing service to facilitate administrative access.

SQL Injection

Advantech Iview

before 5.7.04.6425

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Advantech iView software, specifically within its SNMP management tool. This issue allows unauthorized remote access and could lead to significant compromise of the system. The main concern is confirming if this technology is in use and if it is exposed.

Vulnerability allows unauthorized remote system access.
Important for managing industrial network infrastructure.
Confirm relevance and exposure within your environment.

Attack Path

How an attacker could exploit the issue

Attackers can exploit a vulnerability in Advantech iView's SNMP management tool to bypass authentication and execute remote code with administrator privileges. This is achieved by sending a specially crafted request to the 'NetworkServlet' endpoint, targeting the 'ztp_search_value' parameter, which is susceptible to SQL injection.

No authentication required to attack.
SQL injection in `ztp_search_value` parameter.
Remote code execution as administrator.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow remote attackers to bypass authentication and execute arbitrary code with administrator privileges on the affected system. This is possible when the 'ztp_search_value' parameter in the 'NetworkServlet' endpoint is manipulated to trigger a SQL injection.

Administrator-level system access.
Unauthenticated network requests.
Remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

Teams responsible for industrial control systems, network management, and application infrastructure should prioritize addressing this critical vulnerability. The first practical step involves locating all instances of the affected technology, determining their network reachability and business criticality, identifying the accountable owner, and then developing a remediation plan based on the assessed risk.

Industrial control and network teams own the issue.
Verify system network exposure and criticality.
Plan and coordinate vendor-assisted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Advantech iView?

Advantech iView is a centralized software platform designed for monitoring and managing industrial network infrastructure. It provides administrators with a web-based interface to oversee various connected devices and network health. Organizations rely on it to maintain visibility across their operational environments, making it a critical component for managing the stability and performance of complex industrial systems.

How does CVE-2022-50595 work?

This vulnerability involves two major weaknesses: an authentication bypass and SQL injection. An attacker can skip the login process entirely to access the 'NetworkServlet' endpoint. By manipulating the 'ztp_search_value' parameter, they can inject malicious SQL commands. This effectively tricks the system into executing unauthorized code with full administrator privileges.

Do I need to be authenticated to trigger this bug?

No. The vulnerability specifically allows an attacker to bypass authentication checks. This means the attack does not require a valid user account or password. Simply sending a crafted request to the vulnerable endpoint over the network is sufficient to initiate the exploit process.

Is my instance of Advantech iView at risk?

Halo Surface Signal indicates that Advantech iView is often deployed as an internal or edge-facing service to facilitate administrative access. If your management interface is reachable over a network—especially if it can be accessed from outside your immediate environment—the risk level increases. Determining the network reachability of your installation is vital for assessing your specific situation.

When should I take action for this vulnerability?

You should prioritize addressing this immediately by identifying all deployed instances of iView within your infrastructure. Once you have a list of assets, verify which ones are connected to the network and determine who is responsible for their maintenance. Coordinate with those owners to assess business criticality and begin the remediation process as outlined by the vendor.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.