CVE-2022-50593 is a critical flaw (CVSS 9.8) in Advantech iView. An attacker can bypass authentication and use a SQL injection in the search_term parameter of the NetworkServlet endpoint to run code with administrator privileges. Versions before 5.7.04 build 6425 are affected. Upgrade to build 6425 or newer.
What's affected
The CVE record covers Advantech iView versions prior to v5.7.04 build 6425. Advantech's firmware page for the iView web server lists build 6425 dated 27 January 2022, followed by builds 6469, 6583 and 6752.
This is the sibling of CVE-2022-50591. Both were reported by Exodus Intelligence and both are addressed in the same build, but they sit in different parameters of the same endpoint and have different impact. If you are affected by one, you are affected by both.
How to check if you're exposed
Check the iView version in the web interface or in the install directory and compare it with the build list on the Advantech firmware page. Anything below 5.7.04 build 6425 is in range.
Next, check reachability. The record says the flaw sits in the SNMP management tool behind a servlet, so a network scan that finds the iView port open on user or guest networks is a finding on its own. Move the service to a management VLAN or put it behind a firewall rule that names the admin hosts.
Look at the host the tool runs on too. A server that runs iView with administrator privileges is worth extra scrutiny in your logs, because the record describes code execution at that privilege level.
What to do now
- List every iView instance and its build number.
- Upgrade to build 6425 at least, and preferably to the newest build listed by Advantech.
- Block access to the iView port from everything except administrator workstations.
- Review the host for unexpected processes, new accounts and scheduled tasks if it was exposed before patching.
- Rotate credentials stored in iView, because a compromised management server is a path to the devices it manages.
Why it matters
The record pairs two weaknesses. Missing authentication (CWE-306) means a request can reach sensitive functions without a valid session. SQL injection (CWE-89) then lets attacker controlled input change a database query. The description says successful exploitation leads to remote code execution with administrator privileges, so the database flaw reaches the operating system.
A network management server is a high value target. It knows the addresses and credentials of switches and gateways, and it usually has a path to all of them. Compromising it can give an attacker a view of the whole network. The CVE is not on the CISA Known Exploited Vulnerabilities list, and the record does not describe any attacks in the wild.
Quick check
How is this different from CVE-2022-50591?
Same product and endpoint, but a different parameter. This one reaches code execution as administrator, while the other exposes data including clear text passwords.
Does a firewall help?
It reduces exposure and is worth doing, but the fix is the upgrade to build 6425 or newer.
Sources
- Exodus Intelligence advisory for the search_term SQL injection
- Advantech iView firmware page
- VulnCheck advisory
Last reviewed: 19 October 2026.
