CVE-2025-52694

An attacker without any authentication can send a specially crafted network request to the Advantech IoT Suite service exposed to Internet access. The injected SQL commands are then executed directly by the vulnerable service without input data validation. The attack vector is network-based, does not require user interaction or special privileges, and its scope extends beyond the component where the vulnerability occurred (Scope: Changed).

An attacker can gain unauthorized access to data stored in the database, modify or delete this data, and potentially cause service unavailability — confidentiality, integrity, and system availability are threatened.

All mentioned products must be immediately updated to the latest versions according to manufacturer recommendations and information contained in the references. Until the patch is implemented, it is recommended to limit the exposure of vulnerable services to Internet access through a firewall or other network access control mechanisms.

Advantech IoT Edge Linux Docker, Advantech IoT Edge Windows, Advantech IoTSuite Growth Linux Docker, Advantech IoTSuite SaaS Composer, Advantech IoTSuite Starter Linux Docker — specific versions indicated in manufacturer references