Advantech iView search_term Parameter SQL Injection Remote Code Execution Vulnerability


A vulnerability exists within Advantech iView SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘search_term’ parameter to the ‘NetworkServlet’ endpoint. Successful exploitation allows for remote code execution with administrator privileges.

Vulnerability Identifiers

  • Exodus Intelligence: EIP-626345ce

Vulnerability Metrics

  • CVSSv2 Score: 10.0

Vendor References

Discovery Credit

  • Exodus Intelligence

Disclosure Timeline

  • Disclosed to affected vendor: January 13th, 2022
  • Disclosed to public: March 1st, 2022

Further Information

Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at

Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.