CVE-2022-50591
📋 TL;DR
This vulnerability allows remote attackers to bypass authentication and execute SQL injection attacks on Advantech iView systems. Attackers can exfiltrate user data including clear text passwords. Organizations using Advantech iView versions before v5.7.04 build 6425 are affected.
💻 Affected Systems
- Advantech iView
📦 What is this software?
Iview by Advantech
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the iView system with exfiltration of all user credentials and sensitive data, potentially leading to lateral movement within the network.
Likely Case
Exfiltration of user credentials and sensitive configuration data from the iView database.
If Mitigated
Limited impact if system is isolated behind firewalls with strict network controls and monitoring.
🎯 Exploit Status
The vulnerability combines authentication bypass with SQL injection, making exploitation straightforward. Public technical details are available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v5.7.04 build 6425
Vendor Advisory: https://www.advantech.tw/support/details/firmware?id=1-HIPU-183
Restart Required: Yes
Instructions:
1. Download the patched version v5.7.04 build 6425 from Advantech support portal. 2. Backup current configuration and data. 3. Install the update following vendor instructions. 4. Restart the iView service or system.
🔧 Temporary Workarounds
Network Segmentation
allIsolate iView systems from untrusted networks and restrict access to only necessary IP addresses.
Disable SNMP Management Tool
allTemporarily disable the vulnerable SNMP management tool component if not required.
🧯 If You Can't Patch
- Implement strict network access controls to limit access to iView systems only from trusted management networks.
- Deploy web application firewall (WAF) rules to block SQL injection patterns targeting the NetworkServlet endpoint.
🔍 How to Verify
Check if Vulnerable:
Check iView version in the web interface or configuration files. Versions before v5.7.04 build 6425 are vulnerable.Check Version:
Check the iView web interface under System Information or examine configuration files for version details.Verify Fix Applied:
Verify the version shows v5.7.04 build 6425 or later in the iView interface or configuration.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed authentication attempts followed by successful access
- Requests to NetworkServlet endpoint with suspicious parameters
Network Indicators:
- HTTP requests to /NetworkServlet with SQL injection patterns in parameters
- Unusual outbound database connections from iView system
SIEM Query:
source="iView_logs" AND (uri="/NetworkServlet" AND (param="ztp_config_id" AND value MATCH "[';]"))