CVE-2025-52694

10.0

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet, potentially affecting data confidentiality, integrity, and availability. Users and administrators of affected product versions are advised to update to the latest versions immediately.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

iotsuite and iot edge products

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalWeb Vulnerabilities~10 seconds

Advantech WISE-IoTSuite/SaaS - SQL Injection

Advantech WISE-IoTSuite/SaaS Composer suffers from an unauthenticated SQL Injection vulnerability due to the unsafe use of the `filename` parameter within the URL path in PostgreSQL queries. Remote attackers can exploit this flaw by injecting SQL code (such as the use of `pg_sleep` for time delays) to verify the vulnerability, and may gain further impact such as Remote Code Execution (RCE) depending on the privileges granted to the database user. References: https://www.cve.org/CVERecord?id=CVE-2025-52694 https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001 https://github.com/Winz18/CVE-2025-52694-POC https://nvd.nist.gov/vuln/detail/CVE-2025-52694 Remediation: Apply the latest security patches provided by Advantech or sanitize the `filename` input parameter to prevent SQL injection.

url

Scanner page →Run scanner

CVE history: iotsuite and iot edge products

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →