Overview
CVE-2025-13373 describes a high-severity SQL injection vulnerability affecting Advantech iView versions 5.7.05.7057 and prior. This vulnerability stems from improper sanitization of SNMP v1 trap requests received on Port 162. An attacker could potentially exploit this flaw to inject malicious SQL commands, potentially leading to data breaches, system compromise, or denial of service.
Technical Details
The vulnerability resides in the way Advantech iView processes SNMP v1 trap requests. Specifically, the software fails to adequately sanitize data received within these requests before incorporating it into SQL queries. This lack of input validation allows an attacker to craft a malicious SNMP trap request containing SQL code. When the iView software processes this request, the injected SQL code is executed against the underlying database. This attack vector is particularly concerning because SNMP is a common protocol used for network management and monitoring in industrial control systems (ICS) environments.
CVSS Analysis
The Common Vulnerability Scoring System (CVSS) assigns CVE-2025-13373 a score of 7.5, indicating a HIGH severity. This score reflects the potential for significant impact and the relative ease of exploitation. Key factors contributing to this score include:
- Attack Vector: Network (AV:N) – The vulnerability can be exploited over the network.
- Attack Complexity: Low (AC:L) – Exploitation requires minimal effort and technical skill.
- Privileges Required: None (PR:N) – No authentication is required to exploit the vulnerability.
- User Interaction: None (UI:N) – No user interaction is required to trigger the vulnerability.
- Scope: Changed (S:C) – An exploited vulnerability can affect resources beyond the component.
- Confidentiality Impact: High (C:H) – There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker.
- Integrity Impact: High (I:H) – There is total loss of integrity, resulting in complete and irreversible corruption of the resources.
- Availability Impact: High (A:H) – There is total loss of availability, resulting in the attacker being able to fully interrupt access to all resources.
Possible Impact
Successful exploitation of CVE-2025-13373 can have severe consequences, particularly in industrial environments where Advantech iView is often used. Potential impacts include:
- Data Breach: Attackers could steal sensitive data stored within the iView database, including configuration information, operational data, and user credentials.
- System Compromise: By injecting arbitrary SQL commands, attackers could gain control of the underlying operating system or other connected systems.
- Denial of Service: Attackers could disrupt the availability of iView, hindering monitoring and management capabilities.
- Process Manipulation: In an ICS environment, a compromised iView system could potentially be used to manipulate industrial processes, leading to physical damage or safety hazards.
Mitigation and Patch Steps
Advantech has released a patch to address this vulnerability. It is highly recommended that users of affected iView versions (5.7.05.7057 and prior) take the following steps:
- Upgrade to the latest version of Advantech iView: Download and install the latest version from the Advantech support website. Refer to Advantech’s firmware update page for specific instructions and downloads.
- Implement Network Segmentation: Isolate the iView system within a segmented network to limit the potential impact of a successful attack.
- Restrict Access to Port 162: Limit access to port 162 (SNMP trap) to only authorized devices and networks.
- Monitor SNMP Traffic: Implement intrusion detection systems (IDS) or security information and event management (SIEM) solutions to monitor SNMP traffic for suspicious activity.
- Apply Least Privilege Principle: Ensure that the iView software and its database have only the necessary privileges required to function.
References
- CISA Advisory: ICSA-25-338-07
- Advantech Firmware Update: Advantech Support Website
- CISA CSAF: CSAF File on GitHub
