Cyber Posture

CVE-2022-50593

CriticalPublic PoC

Published: 06 November 2025

Published
06 November 2025
Modified
08 December 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0032 54.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2022-50593 is a critical vulnerability (CVSS 9.8) affecting Advantech iView versions prior to v5.7.04 build 6425. It resides in the SNMP management tool, where attackers can bypass authentication checks to access a SQL injection flaw in the 'search_term' parameter of the 'NetworkServlet' endpoint. The issue combines CWE-89 (SQL Injection) and CWE-306 (Missing Authentication for Critical Function), enabling escalation to remote code execution with administrator privileges.

Remote, unauthenticated attackers can exploit this vulnerability over the network with low complexity and no user interaction required, as indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Successful exploitation grants full administrative remote code execution on the affected iView instance, potentially compromising industrial control systems or SCADA environments where Advantech iView is deployed for device management.

Advantech has addressed the vulnerability via a firmware update to version 5.7.04 build 6425, detailed in their support advisory at https://www.advantech.tw/support/details/firmware?id=1-HIPU-183. Additional technical analysis is available from Exodus Intelligence (https://blog.exodusintel.com/2022/03/01/advantech-iview-search_term-parameter-sql-injection-remote-code-execution-vulnerability/) and VulnCheck (https://www.vulncheck.com/advisories/advantech-iview-searchterm-parameter-sqli-rce), recommending immediate patching and network segmentation for exposed SNMP interfaces.

Details

CWE(s)
CWE-89CWE-306

Affected Products

advantech
iview
≤ 5.7.04.6425

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

CVE-2022-50593 enables unauthenticated remote exploitation of a public-facing web servlet (NetworkServlet) via SQL injection and authentication bypass, directly facilitating T1190: Exploit Public-Facing Application for remote code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References