CVE-2025-62630 is a high severity (CVSS 8.8) path traversal (CWE-22) in Advantech DeviceOn/iEdge, an IoT management platform. A crafted configuration file upload can reach directories it should not and lead to code execution. Advantech says the product is end of life and points to DeviceOn.
What's affected
CISA advisory ICSA-25-310-01 lists DeviceOn/iEdge version 2.0.2 and prior as affected. The same advisory covers two other CVEs for the product, a cross site scripting issue (CVE-2025-64302) and a path traversal in a device dependency (CVE-2025-59171), so patch planning should cover all three.
The record text says an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system level permissions. The CVSS vector needs a low privilege account, no user interaction and a network route.
There is no fixed version of iEdge. According to the CISA advisory, Advantech states that the listed products are end of life and recommends that all users upgrade their devices to DeviceOn, which it says is not vulnerable to these issues.
How to check if you're exposed
Look for DeviceOn/iEdge in your asset inventory and on your OT and IoT network segments. The management web interface is the part to find. Check the product version in the admin interface, and confirm it against 2.0.2 and earlier.
Then answer three practical questions:
- Who can reach the management interface, and from which networks?
- Which accounts exist on it, since the flaw needs a low privilege login?
- Does the host that runs it hold credentials or network access to the devices it manages?
If you cannot find the product by name, ask the team that runs your industrial and edge devices. These systems often sit outside normal software inventories.
What to do now
- Identify every DeviceOn/iEdge install and its version.
- Contact Advantech through the channel named in the CISA advisory to plan the move to DeviceOn.
- Until you migrate, keep the management interface off the internet, behind a VPN or tightly filtered access, as CISA recommends for control system devices.
- Review which accounts have access and remove unused ones, and rotate their passwords.
- Watch for unexpected files in configuration and upload locations on the host, and treat unexplained changes as a possible compromise.
Why it matters
Path traversal happens when a program builds a file location from input and does not confine it to the folder it meant to use. (CWE-22) With an upload feature, that can let a file land somewhere that the system later runs or reads as trusted. Here the impact reaches code execution with system level permissions.
The lasting problem is lifecycle. A vendor retiring a product means no patch will ever arrive, so the fix is replacement, plus tight network controls in the meantime. CISA notes that no known public exploitation targeting these vulnerabilities had been reported to it at the time of publication on 6 November 2025. The record does not mark the CVE as CISA Known Exploited.
Quick check
Is there a patch for iEdge?
No fixed iEdge version is stated. Advantech says the product is end of life and recommends upgrading to DeviceOn. Contact Advantech for help.
Does the attacker need an account?
The CVSS vector says a low privilege account is required, with no user interaction. Treat any shared or default credentials on the system as part of the risk.
Sources
Last reviewed: 18 October 2026.
