Advantech IoTSuite and IoT Edge SQL injection (CVE-2025-52694)

CVE-2025-52694 is a critical vulnerability (CVSS 10.0) affecting multiple Advantech IoTSuite and IoT Edge products. The flaw arises from improper sanitization of the 'filename' parameter in the '/displays/{filename}.json' endpoint, which is directly concatenated into PostgreSQL queries. Unauthenticated attackers can perform stacked queries to extract database information, modify records, or potentially achieve remote code execution depending on database privilege levels. Public exploit scripts and Nuclei templates have been released, elevating the risk of exploitation.

Impact

Successful exploitation allows unauthenticated attackers to conduct unauthorized database queries, potentially leading to full data compromise, unauthorized modification of sensitive information, and remote code execution on the underlying server.

Recommendation

• Patch affected instances immediately: Update IoTSuite SaaS Composer to at least 3.4.15 and all other affected IoTSuite/IoT Edge products to version 2.0.2 or later.
• Implement request validation: Ensure that the 'filename' parameter is strictly validated or that parameterized queries are enforced to prevent SQL injection.
• Deploy network monitoring: Use the hunt leads provided to monitor for suspicious pattern matching in URI paths targeting the identified endpoint.