by Kastro
Paper/Archive/CVE-2025-52694

CVE-2025-52694

Advantech IoTSuite and IoT Edge Products — Execution of arbitrary SQL commands

EPSS 40%CVSS 10.0
critical.is priorityof 100
50
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 98.6.986 × 2019.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet, potentially affecting data confidentiality, integrity, and availability. Users and administrators of affected product versions are advised to update to the latest versions immediately.

Affected

ProductAffectedFixed inSource
IoTSuite and IoT Edge ProductsSaaSComposer prior to version V3.4.15–CNA
IoTSuite and IoT Edge ProductsIoTSuite Growth Linux docker prior to version V2.0.2–CNA
IoTSuite and IoT Edge ProductsIoTSuite Starter Linux docker prior to version V2.0.2–CNA
IoTSuite and IoT Edge ProductsIoT Edge Linux docker prior to version V2.0.2–CNA
IoTSuite and IoT Edge ProductsIoT Edge Windows prior to version V2.0.2–CNA
IoTSuite and IoT Edge ProductsWebAccess/SCADA prior to version V9.2.2–CNA
IoTSuite and IoT Edge ProductsWebAccess SaaS-Composer prior to version 3.4.15.1–CNA
IoTSuite and IoT Edge ProductsECOWatch SaaS-Composer prior to version 3.4.15–CNA

Scores by source

CSA (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcsa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001