CVE-2022-50591: Critical SQL Injection in Advantech iView

CVE-2022-50591 is a critical flaw (CVSS 9.8) in Advantech iView, a network device management tool. A remote attacker can bypass authentication and reach a SQL injection in the ztp_config_id parameter, exposing user data including clear text passwords. Versions before 5.7.04 build 6425 are affected; upgrade to that build or newer.

What's affected

The CVE record lists Advantech iView versions prior to v5.7.04 build 6425. The Exodus Intelligence advisory states the issue is fixed in iView v5.7.04 build 6425.

Advantech's firmware page for the iView web server lists builds 6425, 6469, 6583 and 6752, and notes that a later build fixes a different SQL injection (CVE-2022-3323). That is a good reason to move to the newest build rather than stopping at 6425.

How to check if you're exposed

iView is an appliance style web application, so the quickest check is the version string in its web interface or in the installed package. Compare it with the builds on the Advantech firmware page.

Then check where the interface is reachable. A management tool for network switches should sit on a management network, not on a routable address. Test from a normal user network whether the iView port answers.

If you cannot reach a version number, treat the install as affected and plan the upgrade. Dependency scans do not apply to a vendor appliance, but they remain useful for the rest of your estate, and the Gold directory has the CVE entry for reference.

What to do now

1. Identify every iView install, including ones set up by network teams years ago and forgotten.
2. Upgrade to build 6425 at minimum, and preferably the newest build on the Advantech firmware page.
3. Limit access to the iView interface to management networks or specific admin hosts.
4. Because passwords can be exposed, change the credentials stored in or used by iView, including SNMP credentials, if you suspect earlier exposure.
5. Check Advantech notes for other advisories on the same product line before closing the work.

Why it matters

Two weaknesses combine here. The first is missing authentication on a critical function (CWE-306), which lets a remote caller reach code that should require a login. The second is SQL injection (CWE-89) in the ztp_config_id parameter of the NetworkServlet endpoint, where input is not neutralised before it reaches a database query.

The impact stated in the record is exfiltration of user data, including clear text passwords. Storing passwords in a readable form turns a read only injection into an account takeover problem on every system those passwords unlock. A sibling issue, CVE-2022-50593, uses the same pattern in a different parameter and reaches code execution. This CVE is not on the CISA Known Exploited Vulnerabilities list.

Quick check

Sources

• Exodus Intelligence advisory for the ztp_config_id SQL injection
• Advantech iView firmware page
• VulnCheck advisory

Last reviewed: 19 October 2026.