Advantech DeviceOn/iEdge Remote Code Execution Vulnerability via Path Traversal

A path traversal vulnerability allowing remote code execution with system-level permissions has been identified in Advantech DeviceOn/iEdge versions through 2.0.2. The issue arises from insufficient input sanitization, which enables attackers to upload specially crafted configuration files that traverse directories and execute code remotely, with the execution context of the local system account.

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution with system-level privileges.

Remediation

Advantech has stated that DeviceOn/iEdge version 2.0.2 and prior are end-of-life and recommends all users upgrade to the current version of DeviceOn, which is not vulnerable to this issue. For upgrade assistance, users should contact Advantech.