Advantech
388 CVEs across 118 Advantech products. Browse Advantech vulnerabilities, severities, and proof-of-concept exploits.
Advantech products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-43829 | High | 7.5 | 2026-07-31 | Full details and mitigation steps are currently restricted and will be published at a later date. |
CVE-2026-14162 | Critical | 9.8 | 2026-06-30 | Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific… |
CVE-2026-14161 | High | 7.5 | 2026-06-30 | Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific… |
CVE-2026-6888 | High | 7.2 | 2026-05-13 | Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to execute arbitrary commands via a specific interface, … |
CVE-2026-2670 | High | 7.2 | 2026-02-18 | A vulnerability was identified in Advantech WISE-6610 1.2.1_20251110. Affected is an unknown function of the file /cgi-bin/luci/admin/openvpn_apply of the comp… |
CVE-2025-52694 | Critical | 10.0 | 2026-01-12 | Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable s… |
CVE-2025-67653 | Medium | 4.3 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence of arbitrary files. |
CVE-2025-46268 | Medium | 6.3 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to SQL injection, which may allow an attacker to execute arbitrary SQL commands. |
CVE-2025-14850 | High | 8.1 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files. |
CVE-2025-14849 | High | 8.8 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code. |
CVE-2025-14848 | Medium | 4.3 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files. |
CVE-2025-14252 | High | 7.8 | 2025-12-16 | An Improper Access Control vulnerability in Advantech SUSI driver (susi.sys) allows attackers to read/write arbitrary memory, I/O ports, and MSRs, resulting in… |
CVE-2025-34266 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/addins/menus endpoi… |
CVE-2025-34265 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/rule-engines endpoint. When an au… |
CVE-2025-34264 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/dog/{agentId} endpoint. When an a… |
CVE-2025-34263 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/plugin-config/dashboards/menus en… |
CVE-2025-34262 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devices/name/{agent_id} endpoint… |
CVE-2025-34261 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicegroups/ endpoint. When an a… |
CVE-2025-34260 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/schedule endpoint. When an… |
CVE-2025-34259 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/building endpoint. When… |
CVE-2025-34258 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/devicemap/plan endpoint. When an… |
CVE-2025-34257 | Medium | 5.4 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting (XSS) vulnerability in the /rmm/v1/action/defined endpoint. When an… |
CVE-2025-34256 | Critical | 9.8 | 2025-12-05 | Advantech WISE-DeviceOn Server versions prior to 5.4 contain a hard-coded cryptographic key vulnerability. The product uses a static HS512 HMAC secret for sign… |
CVE-2025-13373 | High | 7.5 | 2025-12-04 | Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could allow an attacker to inject SQL commands. |
CVE-2025-63701 | Medium | 6.8 | 2025-11-14 | A heap corruption vulnerability exists in the Advantech TP-3250 printer driver's DrvUI_x64_ADVANTECH.dll (v0.3.9200.20789) when DocumentPropertiesW() is called… |
CVE-2025-64302 | Medium | 6.4 | 2025-11-06 | Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosure or data manipul… |
CVE-2025-62630 | High | 8.8 | 2025-11-06 | Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution wit… |
CVE-2025-59171 | High | 7.5 | 2025-11-06 | Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution wit… |
CVE-2025-58423 | High | 8.8 | 2025-11-06 | Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories… |
CVE-2025-34247 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low… |
CVE-2025-34246 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated… |
CVE-2025-34245 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authent… |
CVE-2025-34244 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authent… |
CVE-2025-34243 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authen… |
CVE-2025-34242 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-pr… |
CVE-2025-34241 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated l… |
CVE-2025-34240 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticate… |
CVE-2025-34239 | High | 7.2 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenti… |
CVE-2025-34238 | Medium | 6.5 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileActi… |
CVE-2025-34237 | Medium | 5.4 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnCl… |
CVE-2025-34236 | Medium | 5.4 | 2025-11-06 | Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via NetworksController.addNetworkAction(). Insufficie… |
CVE-2022-50595 | High | 7.2 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50594 | High | 7.5 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50593 | Critical | 9.8 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50592 | High | 7.2 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2022-50591 | Critical | 9.8 | 2025-11-06 | Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authent… |
CVE-2025-53519 | Medium | 5.4 | 2025-07-11 | A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulati… |
CVE-2025-53515 | High | 8.8 | 2025-07-11 | A vulnerability exists in Advantech iView that allows for SQL injection and remote code execution through NetworkServlet.archiveTrap(). This issue requires a… |
CVE-2025-53509 | Medium | 6.5 | 2025-07-11 | A vulnerability exists in Advantech iView that allows for argument injection in the NetworkServlet.restoreDatabase(). This issue requires an authenticated at… |
CVE-2025-53475 | High | 8.8 | 2025-07-11 | A vulnerability exists in Advantech iView that could allow for SQL injection and remote code execution through NetworkServlet.getNextTrapPage(). This issue r… |
CVE-2025-53397 | Medium | 5.4 | 2025-07-11 | A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By exploiting… |
CVE-2025-52577 | High | 8.8 | 2025-07-11 | A vulnerability exists in Advantech iView that could allow SQL injection and remote code execution through NetworkServlet.archiveTrapRange(). This issue requ… |
CVE-2025-52459 | Medium | 6.5 | 2025-07-11 | A vulnerability exists in Advantech iView that allows for argument injection in NetworkServlet.backupDatabase(). This issue requires an authenticated attacke… |
CVE-2025-48891 | High | 7.6 | 2025-07-11 | A vulnerability exists in Advantech iView that could allow for SQL injection through the CUtils.checkSQLInjection() function. This vulnerability can be explo… |
CVE-2025-46704 | Medium | 4.3 | 2025-07-11 | A vulnerability exists in Advantech iView in NetworkServlet.processImportRequest() that could allow for a directory traversal attack. This issue requires an… |
CVE-2025-41442 | Medium | 5.4 | 2025-07-11 | A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulati… |
CVE-2025-48470 | Medium | 4.1 | 2025-06-24 | Successful exploitation of the stored cross-site scripting vulnerability could allow an attacker to inject malicious scripts into device fields and executed in… |
CVE-2025-48469 | Critical | 9.6 | 2025-06-24 | Successful exploitation of the vulnerability could allow an unauthenticated attacker to upload firmware through a public update page, potentially leading to ba… |
CVE-2025-48468 | Medium | 6.4 | 2025-06-24 | Successful exploitation of the vulnerability could allow an attacker that has physical access to interface with JTAG to inject or modify firmware. |
CVE-2025-48467 | Medium | 6.5 | 2025-06-24 | Successful exploitation of the vulnerability could allow an attacker to cause repeated reboots, potentially leading to remote denial-of-service and system unav… |
CVE-2025-48466 | High | 8.1 | 2025-06-24 | Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TCP packets to manipulate Digital Outputs, potentia… |
CVE-2025-48463 | Low | 3.1 | 2025-06-24 | Successful exploitation of the vulnerability could allow an attacker to intercept data and conduct session hijacking on the exposed data as the vulnerable prod… |
CVE-2025-48462 | Medium | 4.2 | 2025-06-24 | Successful exploitation of the vulnerability could allow an attacker to consume all available session slots and block other users from logging in, thereby prev… |
CVE-2025-48461 | Medium | 5.0 | 2025-06-24 | Successful exploitation of the vulnerability could allow an unauthenticated attacker to conduct brute force guessing and account takeover as the session cookie… |
CVE-2024-50377 | Medium | 6.5 | 2024-11-26 | A CWE-798 "Use of Hard-coded Credentials" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EKI-6333AC-2GD (<… |
CVE-2024-50376 | High | 7.3 | 2024-11-26 | A CWE-79 "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" was discovered affecting the following devices manufactured by… |
CVE-2024-50375 | Critical | 9.8 | 2024-11-26 | A CWE-306 "Missing Authentication for Critical Function" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6.3), EK… |
CVE-2024-50374 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50373 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50372 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50371 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50370 | Critical | 9.8 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50369 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50368 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50367 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50366 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50365 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50364 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50363 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50362 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50361 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50360 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50359 | High | 7.2 | 2024-11-26 | A CWE-78 "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')" was discovered affecting the following devices manufactur… |
CVE-2024-50358 | High | 7.2 | 2024-11-26 | A CWE-15 "External Control of System or Configuration Setting" was discovered affecting the following devices manufactured by Advantech: EKI-6333AC-2G (<= 1.6… |
CVE-2023-52335 | High | 7.5 | 2024-11-22 | Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive infor… |
CVE-2024-39364 | Medium | 6.3 | 2024-09-27 | Advantech ADAM-5630 has built-in commands that can be executed without authenticating the user. These commands allow for restarting the operating system, re… |
CVE-2024-39275 | High | 8.0 | 2024-09-27 | Cookies of authenticated Advantech ADAM-5630 users remain as active valid cookies when a session is closed. Forging requests with a legitimate cookie, even if… |
CVE-2024-38308 | High | 8.8 | 2024-09-27 | Advantech ADAM 5550's web application includes a "logs" page where all the HTTP requests received are displayed to the user. The device doesn't correctly neu… |
CVE-2024-37187 | Medium | 5.7 | 2024-09-27 | Advantech ADAM-5550 share user credentials with a low level of encryption, consisting of base 64 encoding. |
CVE-2024-34542 | Medium | 5.7 | 2024-09-27 | Advantech ADAM-5630 shares user credentials plain text between the device and the user source device during the login process. |
CVE-2024-28948 | High | 8.0 | 2024-09-27 | Advantech ADAM-5630 contains a cross-site request forgery (CSRF) vulnerability. It allows an attacker to partly circumvent the same origin policy, which is de… |
CVE-2024-2453 | Medium | 6.4 | 2024-03-21 | There is an SQL injection vulnerability in Advantech WebAccess/SCADA software that allows an authenticated attacker to remotely inject SQL code in the databas… |
CVE-2023-5642 | Critical | 9.8 | 2023-10-18 | Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitive information. |
CVE-2023-4215 | Medium | 6.5 | 2023-10-17 | Advantech WebAccess version 9.1.3 contains an exposure of sensitive information to an unauthorized actor vulnerability that could leak user credentials. |
CVE-2023-4203 | Critical | 9.0 | 2023-08-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticate… |
CVE-2023-4202 | Critical | 9.0 | 2023-08-08 | Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by a Stored Cross-Site Scripting vulnerability, which can be triggered by authenticate… |
CVE-2023-1437 | Critical | 9.8 | 2023-08-02 | All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memor… |
CVE-2023-3983 | High | 8.8 | 2023-07-31 | An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. An authenticated remote attacker can bypass checks… |
CVE-2023-3256 | High | 8.8 | 2023-06-22 | Advantech R-SeeNet versions 2.4.22 allows low-level users to access and load the content of local files. |
CVE-2023-2611 | Critical | 9.8 | 2023-06-22 | Advantech R-SeeNet versions 2.4.22 is installed with a hidden root-level user that is not available in the users list. This hidden user has a password that… |