CVE-2025-59171 is a high severity (CVSS 7.5) path traversal in Advantech DeviceOn/iEdge, an IoT management platform. CISA lists version 2.0.2 and prior as affected. Advantech says the product is end of life and recommends upgrading to DeviceOn, which is not vulnerable.
What's affected
CISA advisory ICSA-25-310-01 lists DeviceOn/iEdge version 2.0.2 and prior as affected. The same advisory records Advantech's statement that the listed products are end of life and that all users should upgrade to DeviceOn, which Advantech says is not vulnerable.
There is no patch for the old product line to apply. The remedy is a migration.
How to check if you're exposed
Find where iEdge is installed. For an IoT management platform that often means a gateway or server in an operational network that nobody has touched in a while.
Check the product version from its own management interface or the installed program list, and compare it with 2.0.2. Review network exposure too: the CVSS vector says the flaw is reachable over the network without privileges or user interaction, so see whether the service is reachable from places it should not be.
What to do now
- Inventory every DeviceOn/iEdge instance and record its version and network location.
- Contact Advantech about the move to DeviceOn, as the advisory suggests.
- Until you migrate, restrict network access to the iEdge service to the management hosts that need it.
- Follow the CISA recommendations for control systems: keep them off the public internet and behind firewalls, and use a VPN for remote access.
- Monitor the host for unexpected file changes and unusual processes.
Why it matters
The record maps this to CWE-22, path traversal. The NVD text says an attacker can upload a crafted configuration file to traverse directories and reach code execution with system level permissions.
There is a source conflict worth noting. CISA's advisory describes CVE-2025-59171 as a flaw in a device dependency that lets an unauthenticated attacker read arbitrary files or bypass authentication, and it attaches the configuration file upload and code execution description to a different CVE, CVE-2025-62630. The NVD vector for this record (confidentiality high, integrity and availability none) matches a file read, not code execution. Plan for the worse case, but read the advisory when you brief others. This CVE is not on the CISA KEV list.
Path traversal weaknesses arise when a program builds a file path from input it does not control and does not confirm the result stays inside the intended directory. Depending on whether the code reads or writes, the outcome is disclosure of files or the placement of files where they should not be.
The standard defence is to resolve the final path, compare it against the allowed base directory, and refuse anything outside it. Running the service as an unprivileged user, with a file system that only exposes what it needs, limits how far a mistake can reach.
Industrial and IoT management software tends to live for years after the vendor stops supporting it. That makes the inventory step more than a formality. If nobody can say where iEdge runs, that is the first thing to fix.
A dependency scan will not see this one, because it concerns a product or service rather than a package in your code. The practical step is an asset inventory that records which of these products you run, which version, and who owns it. You can look up the record for this CVE in the Safeguard Gold directory and use the free scan at gold.safeguard.sh/scan for the software you build yourself.
Quick check
Is there a patch for CVE-2025-59171?
Advantech says the affected products are end of life and recommends moving to DeviceOn. No patch for the old line is listed.
Does this CVE give code execution?
The NVD text says so, but CISA's advisory describes it as file read or authentication bypass and assigns code execution to another CVE. Treat the advisory as the more specific source.
Sources
- CISA ICS advisory ICSA-25-310-01
- NVD record data for CVE-2025-59171
Last reviewed: 18 October 2026.
