Summary
Successful exploitation of these vulnerabilities could allow an attacker to read or modify sensitive data, disclose information, or execute arbitrary code.
Vulnerabilities 7
-
Critical 9.8
Advantech iView
The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.
-
High 8.8
Advantech iView
The affected product is vulnerable to multiple SQL injections that require low privileges for exploitation and may allow an unauthorized attacker to disclose information.
-
High 8.2CVE-2022-2138 EPSS 12%
Advantech iView
The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute arbitrary code, resulting in a denial-of-service condition.
-
High 8.1
Advantech iView
The affected product is vulnerable to a SQL injection with high attack complexity, which may allow an unauthorized attacker to disclose information.
-
High 7.5CVE-2022-2135 EPSS 11%
Advantech iView
The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information.
-
Medium 6.5CVE-2022-2139 EPSS 16%
Advantech iView
The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and execute arbitrary code.
-
Medium 4.9
Advantech iView
The affected product is vulnerable to two SQL injections that require high privileges for exploitation and may allow an unauthorized attacker to disclose information
Revision history
-
#1
Publication Date
References
-
ICS Advisory ICSA-22-179-03 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-179-03
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B