Vulnerability-Lookup

VAR-202206-2050

Vulnerability from variot - Updated: 2026-04-10 23:52

The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information. Authentication is not required to exploit this vulnerability.The specific flaw exists within the NetworkServlet endpoint, which listens on TCP port 8080 by default. When parsing the PROP_GetCommunity and PROP_SetCommunity elements of the performSearchDevice action, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Advantech iView

Show details on source website

JSON

To clipboard

{
  "affected_products": {
    "_id": null,
    "data": [
      {
        "_id": null,
        "model": "iview",
        "scope": null,
        "trust": 11.2,
        "vendor": "advantech",
        "version": null
      },
      {
        "_id": null,
        "model": "iview",
        "scope": "lt",
        "trust": 1.0,
        "vendor": "advantech",
        "version": "5.7.04.6469"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-919"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-918"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-917"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-916"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-915"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-914"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-912"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-908"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-906"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-902"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-898"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-896"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-892"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-888"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-886"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-882"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-2135"
      }
    ]
  },
  "credits": {
    "_id": null,
    "data": "@rgod777",
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-919"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-916"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-915"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-914"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-912"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-908"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-902"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-898"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-896"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-888"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-886"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-882"
      }
    ],
    "trust": 8.4
  },
  "cve": "CVE-2022-2135",
  "cvss": {
    "_id": null,
    "data": [
      {
        "cvssV2": [],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "ZDI",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2022-2135",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 8.4,
            "userInteraction": "NONE",
            "vectorString": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "ZDI",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2022-2135",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.8,
            "userInteraction": "NONE",
            "vectorString": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 3.9,
            "id": "CVE-2022-2135",
            "impactScore": 3.6,
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "trust": 2.0,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        ],
        "severity": [
          {
            "author": "ZDI",
            "id": "CVE-2022-2135",
            "trust": 8.4,
            "value": "HIGH"
          },
          {
            "author": "ZDI",
            "id": "CVE-2022-2135",
            "trust": 2.8,
            "value": "CRITICAL"
          },
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2022-2135",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "ics-cert@hq.dhs.gov",
            "id": "CVE-2022-2135",
            "trust": 1.0,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-919"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-918"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-917"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-916"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-915"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-914"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-912"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-908"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-906"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-902"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-898"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-896"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-892"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-888"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-886"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-882"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-2135"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-2135"
      }
    ]
  },
  "description": {
    "_id": null,
    "data": "The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information. Authentication is not required to exploit this vulnerability.The specific flaw exists within the NetworkServlet endpoint, which listens on TCP port 8080 by default. When parsing the PROP_GetCommunity and PROP_SetCommunity elements of the performSearchDevice action, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Advantech iView",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2022-2135"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-918"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-882"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-886"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-888"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-892"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-896"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-898"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-919"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-906"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-908"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-912"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-914"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-915"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-916"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-917"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-902"
      },
      {
        "db": "VULHUB",
        "id": "VHN-426269"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-2135"
      }
    ],
    "trust": 11.16
  },
  "external_ids": {
    "_id": null,
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2022-2135",
        "trust": 12.4
      },
      {
        "db": "ICS CERT",
        "id": "ICSA-22-179-03",
        "trust": 1.2
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16750",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-919",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16529",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-918",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16535",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-917",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16561",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-916",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16585",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-915",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16562",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-914",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16751",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-912",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16747",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-908",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16546",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-906",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16731",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-902",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16693",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-898",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16694",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-896",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16547",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-892",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16563",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-888",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16560",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-886",
        "trust": 0.7
      },
      {
        "db": "ZDI_CAN",
        "id": "ZDI-CAN-16647",
        "trust": 0.7
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-882",
        "trust": 0.7
      },
      {
        "db": "VULHUB",
        "id": "VHN-426269",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-2135",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-919"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-918"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-917"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-916"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-915"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-914"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-912"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-908"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-906"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-902"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-898"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-896"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-892"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-888"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-886"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-882"
      },
      {
        "db": "VULHUB",
        "id": "VHN-426269"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-2135"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-2135"
      }
    ]
  },
  "id": "VAR-202206-2050",
  "iot": {
    "_id": null,
    "data": true,
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-426269"
      }
    ],
    "trust": 0.01
  },
  "last_update_date": "2026-04-10T23:52:15.611000Z",
  "patch": {
    "_id": null,
    "data": [
      {
        "title": "Advantech has issued an update to correct this vulnerability.",
        "trust": 11.2,
        "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-03"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-919"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-918"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-917"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-916"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-915"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-914"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-912"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-908"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-906"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-902"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-898"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-896"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-892"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-888"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-886"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-882"
      }
    ]
  },
  "problemtype_data": {
    "_id": null,
    "data": [
      {
        "problemtype": "CWE-89",
        "trust": 1.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-426269"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-2135"
      }
    ]
  },
  "references": {
    "_id": null,
    "data": [
      {
        "trust": 12.4,
        "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-03"
      }
    ],
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-919"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-918"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-917"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-916"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-915"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-914"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-912"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-908"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-906"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-902"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-898"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-896"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-892"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-888"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-886"
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-882"
      },
      {
        "db": "VULHUB",
        "id": "VHN-426269"
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-2135"
      },
      {
        "db": "NVD",
        "id": "CVE-2022-2135"
      }
    ]
  },
  "sources": {
    "_id": null,
    "data": [
      {
        "db": "ZDI",
        "id": "ZDI-22-919",
        "ident": null
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-918",
        "ident": null
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-917",
        "ident": null
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-916",
        "ident": null
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-915",
        "ident": null
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-914",
        "ident": null
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-912",
        "ident": null
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-908",
        "ident": null
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-906",
        "ident": null
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-902",
        "ident": null
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-898",
        "ident": null
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-896",
        "ident": null
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-892",
        "ident": null
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-888",
        "ident": null
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-886",
        "ident": null
      },
      {
        "db": "ZDI",
        "id": "ZDI-22-882",
        "ident": null
      },
      {
        "db": "VULHUB",
        "id": "VHN-426269",
        "ident": null
      },
      {
        "db": "VULMON",
        "id": "CVE-2022-2135",
        "ident": null
      },
      {
        "db": "NVD",
        "id": "CVE-2022-2135",
        "ident": null
      }
    ]
  },
  "sources_release_date": {
    "_id": null,
    "data": [
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-919",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-918",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-917",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-916",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-915",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-914",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-912",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-908",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-906",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-902",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-898",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-896",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-892",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-888",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-886",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-882",
        "ident": null
      },
      {
        "date": "2022-07-22T00:00:00",
        "db": "VULHUB",
        "id": "VHN-426269",
        "ident": null
      },
      {
        "date": "2022-07-22T15:15:08.117000",
        "db": "NVD",
        "id": "CVE-2022-2135",
        "ident": null
      }
    ]
  },
  "sources_update_date": {
    "_id": null,
    "data": [
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-919",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-918",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-917",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-916",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-915",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-914",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-912",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-908",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-906",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-902",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-898",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-896",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-892",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-888",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-886",
        "ident": null
      },
      {
        "date": "2022-06-30T00:00:00",
        "db": "ZDI",
        "id": "ZDI-22-882",
        "ident": null
      },
      {
        "date": "2022-07-28T00:00:00",
        "db": "VULHUB",
        "id": "VHN-426269",
        "ident": null
      },
      {
        "date": "2022-07-28T20:10:10.260000",
        "db": "NVD",
        "id": "CVE-2022-2135",
        "ident": null
      }
    ]
  },
  "title": {
    "_id": null,
    "data": "Advantech iView setTaskEditorItem DESCRIPTION  SQL Injection Remote Code Execution Vulnerability",
    "sources": [
      {
        "db": "ZDI",
        "id": "ZDI-22-919"
      }
    ],
    "trust": 0.7
  }
}

CVE-2022-2135 (GCVE-0-2022-2135)

Vulnerability from cvelistv5 – Published: 2022-07-22 14:58 – Updated: 2025-04-16 16:14

Title

Advantech iView

Summary

The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information.

Severity ?

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE

CWE-89 - SQL Injection

Assigner

icscert

References

URL

Tags

https://www.cisa.gov/uscert/ics/advisories/icsa-2…

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	Advantech iView	iView	Affected: All , < 5_7_04_6469 (custom)

Date Public ?

2022-06-28 00:00

Credits

rgod, working with Trend Micro’s Zero Day Initiative, reported these vulnerabilities to CISA

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:24:44.328Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-03"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2022-2135",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-16T15:55:02.234169Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-04-16T16:14:00.977Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "iView",
          "vendor": "Advantech iView",
          "versions": [
            {
              "lessThan": "5_7_04_6469",
              "status": "affected",
              "version": "All",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "rgod, working with Trend Micro\u2019s Zero Day Initiative, reported these vulnerabilities to CISA"
        }
      ],
      "datePublic": "2022-06-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89 SQL Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-22T14:58:45.000Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-03"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Advantech recommends updating firmware to Version 5_7_4_6469 to address these vulnerabilities."
        }
      ],
      "source": {
        "advisory": "ICSA-22-179-03",
        "discovery": "EXTERNAL"
      },
      "title": "Advantech iView",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "DATE_PUBLIC": "2022-06-28T17:00:00.000Z",
          "ID": "CVE-2022-2135",
          "STATE": "PUBLIC",
          "TITLE": "Advantech iView"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "iView",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_name": "All",
                            "version_value": "5_7_04_6469"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Advantech iView"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "rgod, working with Trend Micro\u2019s Zero Day Initiative, reported these vulnerabilities to CISA"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-89 SQL Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-03",
              "refsource": "MISC",
              "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-179-03"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Advantech recommends updating firmware to Version 5_7_4_6469 to address these vulnerabilities."
          }
        ],
        "source": {
          "advisory": "ICSA-22-179-03",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2022-2135",
    "datePublished": "2022-07-22T14:58:45.454Z",
    "dateReserved": "2022-06-20T00:00:00.000Z",
    "dateUpdated": "2025-04-16T16:14:00.977Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

VAR-202206-2050

CVE-2022-2135 (GCVE-0-2022-2135)

Tags

Sightings

Nomenclature