Advantech DeviceOn/iEdge Remote Code Execution Vulnerability via Path Traversal

A path traversal vulnerability allowing remote code execution with system-level permissions has been identified in Advantech DeviceOn/iEdge versions through 2.0.2. The issue arises from insufficient input sanitization, which enables attackers to upload specially crafted configuration files that traverse directories and execute code remotely, with the execution context of the local system account.

Impact

Exploitation of this vulnerability could lead to unauthorized remote code execution with system-level privileges.

Remediation

Advantech has stated that DeviceOn/iEdge is end-of-life and recommends users upgrade to the latest version of DeviceOn, which is not vulnerable to this issue. For upgrade assistance, users should contact Advantech.