module
Advantech iView NetworkServlet Command Injection
| Disclosed |
|---|
| Jun 28, 2022 |
Disclosed
Jun 28, 2022
Description
Versions of Advantech iView software below `5.7.04.6469` are
vulnerable to an unauthenticated command injection vulnerability
via the `NetworkServlet` endpoint.
The database backup functionality passes a user-controlled parameter,
`backup_file` to the `mysqldump` command. The sanitization functionality only
tests for SQL injection attempts and directory traversal, so leveraging the
`-r` and `-w` `mysqldump` flags permits exploitation.
The command injection vulnerability is used to write a payload on the target
and achieve remote code execution as NT AUTHORITY\SYSTEM.
vulnerable to an unauthenticated command injection vulnerability
via the `NetworkServlet` endpoint.
The database backup functionality passes a user-controlled parameter,
`backup_file` to the `mysqldump` command. The sanitization functionality only
tests for SQL injection attempts and directory traversal, so leveraging the
`-r` and `-w` `mysqldump` flags permits exploitation.
The command injection vulnerability is used to write a payload on the target
and achieve remote code execution as NT AUTHORITY\SYSTEM.
Rapid7 Labs
2026 Global Threat Landscape Report
The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.