advantech vulnerabilities

Recent CVEs affecting advantech products. 82 tracked.

advantech has 82 tracked vulnerabilities, 11 critical. A fixed release or vendor patch exists for 66. Most recent: 2026-01-12. Highest priority: CVE-2025-52694 (score 73/100).

CVE-2025-34259 MEDIUM 5.4 UPGRADE Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability
CVE-2025-34260 MEDIUM 5.4 UPGRADE Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability
CVE-2025-34261 MEDIUM 5.4 UPGRADE Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability
CVE-2025-34258 MEDIUM 5.4 UPGRADE Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability
CVE-2025-34262 MEDIUM 5.4 UPGRADE Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability
CVE-2025-34263 MEDIUM 5.4 UPGRADE Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability
CVE-2025-34264 MEDIUM 5.4 UPGRADE Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability
CVE-2025-34265 MEDIUM 5.4 UPGRADE Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability
CVE-2025-34266 MEDIUM 5.4 UPGRADE Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability
CVE-2025-59171 HIGH 7.5 UPGRADE Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse d
CVE-2025-34239 HIGH 7.2 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementCont
CVE-2025-62630 HIGH 8.8 UPGRADE Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse d
CVE-2025-58423 HIGH 8.8 UPGRADE Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a de
CVE-2025-34238 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClient
CVE-2025-34240 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementControll
CVE-2025-34241 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.
CVE-2025-34242 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController
CVE-2025-34243 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController
CVE-2025-34244 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController
CVE-2025-34245 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClie
CVE-2025-34246 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationCont
CVE-2025-34247 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.ad
CVE-2025-34236 MEDIUM 5.4 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via
CVE-2025-34237 MEDIUM 5.4 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via
CVE-2025-14849 HIGH 8.8 DOWNGRADE Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely
CVE-2025-34257 MEDIUM 5.4 UPGRADE Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability
CVE-2025-67653 MEDIUM 4.3 DOWNGRADE Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the e
CVE-2025-64302 MEDIUM 6.4 UPGRADE Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device erro
CVE-2025-63701 MEDIUM 6.8 MITIGATE A heap corruption vulnerability exists in the Advantech TP-3250 printer driver's DrvUI_x64_ADVANTECH.dll (v0.3
CVE-2025-53519 MEDIUM 5.4 UPGRADE A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected
CVE-2025-53515 HIGH 8.8 UPGRADE A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution through Net
CVE-2025-53509 MEDIUM 6.5 UPGRADE A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDat
CVE-2025-53475 HIGH 8.8 UPGRADE A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution throug
CVE-2025-53397 MEDIUM 5.4 UPGRADE A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected
CVE-2025-52694 CRITICAL 10.0 UPGRADE UPGRADE Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to e
CVE-2025-52577 HIGH 8.8 UPGRADE A vulnerability exists in Advantech iView that could allow SQL injection and remote code execution through Ne
CVE-2025-48891 HIGH 7.6 UPGRADE A vulnerability exists in Advantech iView that could allow for SQL injection through the CUtils.checkSQLInjec
CVE-2025-48470 MEDIUM 4.1 MITIGATE MITIGATE Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject mal
CVE-2025-48469 CRITICAL 9.6 MITIGATE MITIGATE Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware throug
CVE-2025-48468 MEDIUM 6.4 MITIGATE MITIGATE Successful exploitation of the vulnerability could allow an attacker that has physical access to interface wit
CVE-2025-48467 MEDIUM 6.5 MITIGATE MITIGATE Successful exploitation of the vulnerability could allow an attacker to cause repeated reboots, potentially le
CVE-2025-48466 HIGH 8.1 MITIGATE MITIGATE Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TC
CVE-2025-48463 LOW 3.1 MITIGATE MITIGATE Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hij
CVE-2025-48462 MEDIUM 4.2 MITIGATE MITIGATE Successful exploitation of the vulnerability could allow an attacker to consume all available session slots an
CVE-2025-48461 MEDIUM 5.0 MITIGATE MITIGATE Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force gu
CVE-2025-46704 MEDIUM 4.3 UPGRADE A vulnerability exists in Advantech iView in NetworkServlet.processImportRequest() that could allow for a dir
CVE-2025-46268 MEDIUM 6.3 DOWNGRADE Advantech WebAccess/SCADA is vulnerable to SQL injection, which may allow an attacker to execute arbitrary SQ
CVE-2025-41442 MEDIUM 5.4 UPGRADE A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected
CVE-2025-34256 CRITICAL 9.8 UPGRADE Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability
CVE-2025-14850 HIGH 8.1 DOWNGRADE Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrar
CVE-2025-14848 MEDIUM 4.3 DOWNGRADE Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determ
CVE-2024-50377 MEDIUM 6.5 UPGRADE UPGRADE A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advan
CVE-2024-50376 HIGH 7.3 UPGRADE UPGRADE A CWE-79 "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" was discovered
CVE-2024-50375 CRITICAL 9.8 UPGRADE UPGRADE A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufa
CVE-2024-50374 CRITICAL 9.8 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50373 CRITICAL 9.8 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50372 CRITICAL 9.8 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50371 CRITICAL 9.8 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50370 CRITICAL 9.8 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50369 HIGH 7.2 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50368 HIGH 7.2 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50367 HIGH 7.2 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50366 HIGH 7.2 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50365 HIGH 7.2 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50364 HIGH 7.2 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50363 HIGH 7.2 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50362 HIGH 7.2 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50361 HIGH 7.2 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50360 HIGH 7.2 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50359 HIGH 7.2 UPGRADE UPGRADE A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was disc
CVE-2024-50358 HIGH 7.2 UPGRADE UPGRADE A CWE-15 "External Control of System or Configuration Setting" was discovered affecting the following devices
CVE-2024-39275 HIGH 8.0 UPGRADE Cookies of authenticated Advantech ADAM-5630 users remain as active valid cookies when a session is closed
CVE-2024-38308 HIGH 8.8 MITIGATE Advantech ADAM 5550's web application includes a "logs" page where all the HTTP requests received are display
CVE-2024-37187 MEDIUM 5.7 MITIGATE Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding.
CVE-2024-34542 MEDIUM 5.7 UPGRADE Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during th
CVE-2024-28948 HIGH 8.0 UPGRADE Advantech ADAM-5630 contains a cross-site request forgery (CSRF) vulnerability
CVE-2023-52335 HIGH 7.5 UPGRADE Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability
CVE-2022-50595 HIGH 7.2 UPGRADE Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool t
CVE-2022-50594 HIGH 7.5 UPGRADE Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool t
CVE-2022-50593 CRITICAL 9.8 UPGRADE Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool t
CVE-2022-50592 HIGH 7.2 UPGRADE Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool t
CVE-2022-50591 CRITICAL 9.8 UPGRADE Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool t

FAQ

How do I fix advantech vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is advantech being exploited right now?

None of the tracked advantech CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which advantech CVE should I patch first?

CVE-2025-52694 currently ranks highest (73/100): Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to e.

Products

RSS feed for advantech · ← Back to latest CVEs