Advantech iView SNMP Authentication Bypass and SQL Injection Vulnerability

A vulnerability exists in Advantech iView versions prior to 5.7.04 build 6425 within the SNMP management tool. This vulnerability allows remote attackers to bypass authentication checks and exploit a SQL injection flaw in the 'data' parameter of the 'NetworkServlet' endpoint. Successful exploitation could lead to the exfiltration of user data, including clear text passwords.

Impact

Exploitation of this vulnerability allows for authentication bypass, followed by SQL injection, which could be used to exfiltrate user data, including clear text passwords.

Remediation

Users can upgrade to Advantech iView version 5.7.04 build 6425 or later to address this vulnerability.