Advantech DeviceOn/iEdge Insufficient Input Sanitization Vulnerability Allowing Information Disclosure and Data Manipulation

A vulnerability exists in Advantech DeviceOn/iEdge versions through 2.0.2, due to inadequate input sanitization in the dashboard label or path. This flaw can be exploited to trigger device errors, leading to unauthorized information disclosure or manipulation of data. Additionally, this vulnerability has been associated with cross-site scripting.

Impact

Exploitation of this vulnerability could result in a denial-of-service condition, remote code execution, or unauthorized access to arbitrary files.

Remediation

Advantech has stated that DeviceOn/iEdge is end-of-life and recommends users upgrade to the current version of DeviceOn, which is not vulnerable. For upgrade assistance, users should contact Advantech.