Advantech iView SNMP Management Tool Authentication Bypass and SQL Injection Vulnerability Allowing Remote Code Execution

A vulnerability exists in Advantech iView versions prior to 5.7.04 build 6425, within the SNMP management tool. This vulnerability allows remote attackers to bypass authentication checks and exploit a SQL injection flaw in the 'ztp_search_value' parameter of the 'NetworkServlet' endpoint. Successful exploitation of this vulnerability leads to remote code execution with administrator privileges.

Impact

Exploitation of this vulnerability allows for remote code execution with administrator privileges on the affected system.

Remediation

Users can upgrade to Advantech iView version 5.7.04 build 6425 or later to address this vulnerability.