IoT Edge Windows (< 2.0.2) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/iot-edge-windows--2.0.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 13:02:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAdvantech IoTSuite and IoT Edge SQL injection (CVE-2025-52694)https://feed.craftedsignal.io/briefs/2026-10-advantech-sql-injection/Wed, 28 Oct 2026 13:02:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-advantech-sql-injection/CVE-2025-52694 is a critical unauthenticated SQL injection vulnerability in Advantech IoTSuite and IoT Edge products that allows remote database manipulation and potential code execution.CVE-2025-52694 is a critical vulnerability (CVSS 10.0) affecting multiple Advantech IoTSuite and IoT Edge products. The flaw arises from improper sanitization of the 'filename' parameter in the '/displays/{filename}.json' endpoint, which is directly concatenated into PostgreSQL queries. Unauthenticated attackers can perform stacked queries to extract database information, modify records, or potentially achieve remote code execution depending on database privilege levels. Public exploit scripts and Nuclei templates have been released, elevating the risk of exploitation.

Impact

Successful exploitation allows unauthenticated attackers to conduct unauthorized database queries, potentially leading to full data compromise, unauthorized modification of sensitive information, and remote code execution on the underlying server.

Recommendation

  • Patch affected instances immediately: Update IoTSuite SaaS Composer to at least 3.4.15 and all other affected IoTSuite/IoT Edge products to version 2.0.2 or later.
  • Implement request validation: Ensure that the 'filename' parameter is strictly validated or that parameterized queries are enforced to prevent SQL injection.
  • Deploy network monitoring: Use the hunt leads provided to monitor for suspicious pattern matching in URI paths targeting the identified endpoint.
]]>criticaladvisorysqlivulnerabilityiot