CVE-2025-52694 - Vulnerability Details - OpenCVE

Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Advantech	Iot Edge Products Iotsuite

No data.

No data.

References

Link	Providers
https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001/

History

Mon, 12 Jan 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-89
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Mon, 12 Jan 2026 14:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Advantech Advantech iot Edge Products Advantech iotsuite
Vendors & Products		Advantech Advantech iot Edge Products Advantech iotsuite

Mon, 12 Jan 2026 10:30:00 +0000

Type	Values Removed	Values Added
References	https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-127/

Mon, 12 Jan 2026 09:45:00 +0000

Type	Values Removed	Values Added
References		https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001/

Mon, 12 Jan 2026 03:15:00 +0000

Type	Values Removed	Values Added
Description		Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet.
Title		Execution of arbitrary SQL commands
References		https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-127/
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: CSA

Published: 2026-01-12T02:27:16.744Z

Updated: 2026-01-12T14:31:52.735Z

Reserved: 2025-06-19T06:04:41.987Z

Link: CVE-2025-52694

Vulnrichment

Updated: 2026-01-12T14:31:49.132Z

NVD

Status : Awaiting Analysis

Published: 2026-01-12T03:16:07.127

Modified: 2026-01-13T14:03:18.990

Link: CVE-2025-52694

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-52694", "assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4", "state": "PUBLISHED", "assignerShortName": "CSA", "dateReserved": "2025-06-19T06:04:41.987Z", "datePublished": "2026-01-12T02:27:16.744Z", "dateUpdated": "2026-01-12T14:31:52.735Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "product": "IoTSuite and IoT Edge Products", "vendor": "Advantech", "versions": [{"status": "affected", "version": "IoTSuite SaaSComposer prior to version 3.4.15"}, {"status": "affected", "version": "IoTSuite Growth Linux docker prior to version V2.0.2"}, {"status": "affected", "version": "IoTSuite Starter Linux docker prior to version V2.0.2"}, {"status": "affected", "version": "IoT Edge Linux docker prior to version V2.0.2"}, {"status": "affected", "version": "IoT Edge Windows prior to version V2.0.2"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Loi Nguyen Thang"}], "datePublic": "2026-01-12T02:21:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet."}], "value": "Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "providerMetadata": {"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4", "shortName": "CSA", "dateUpdated": "2026-01-12T09:20:30.502Z"}, "references": [{"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001/"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Users and administrators of affected product versions are advised to update to the latest versions immediately.\n\n<br>\n\n<p>For IoTSuite SaaSComposer<a target=\"_blank\" rel=\"nofollow\">, IoTSuite Growth Linux docker</a>, and <a target=\"_blank\" rel=\"nofollow\">IoT Edge Windows</a> please contact Advantech <a target=\"_blank\" rel=\"nofollow\" href=\"https://wise-iot.advantech.com/en-tw/marketplace/help/technical-support\">here </a>for the official release of the fixed version. </p><p>For <a target=\"_blank\" rel=\"nofollow\">IoTSuite Starter Linux docker</a>, please download the update <a target=\"_blank\" rel=\"nofollow\" href=\"https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/JqNWAMGz1JQ?tenantId=VGVuYW50.aSUET6-KO-0qXOBh\">here</a>. </p><p>For <a target=\"_blank\" rel=\"nofollow\">IoT Edge Linux docker</a>, please download the update <a target=\"_blank\" rel=\"nofollow\" href=\"https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/G0yWBn2mp2q?tenantId=VGVuYW50.aSUET6-KO-0qXOBh\">here</a>.</p>"}], "value": "Users and administrators of affected product versions are advised to update to the latest versions immediately.\n\n\n\n\nFor IoTSuite SaaSComposer here https://wise-iot.advantech.com/en-tw/marketplace/help/technical-support for the official release of the fixed version.\u00a0\n\nFor here https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/JqNWAMGz1JQ .\u00a0\n\nFor here https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/G0yWBn2mp2q ."}], "source": {"discovery": "UNKNOWN"}, "title": "Execution of arbitrary SQL commands", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-12T14:31:37.398331Z", "id": "CVE-2025-52694", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T14:31:52.735Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-52694", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-12T14:31:37.398331Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-12T14:31:49.132Z"}}], "cna": {"title": "Execution of arbitrary SQL commands", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Loi Nguyen Thang"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 10, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Advantech", "product": "IoTSuite and IoT Edge Products", "versions": [{"status": "affected", "version": "IoTSuite SaaSComposer prior to version 3.4.15"}, {"status": "affected", "version": "IoTSuite Growth Linux docker prior to version V2.0.2"}, {"status": "affected", "version": "IoTSuite Starter Linux docker prior to version V2.0.2"}, {"status": "affected", "version": "IoT Edge Linux docker prior to version V2.0.2"}, {"status": "affected", "version": "IoT Edge Windows prior to version V2.0.2"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Users and administrators of affected product versions are advised to update to the latest versions immediately.\n\n\n\n\nFor IoTSuite SaaSComposer here https://wise-iot.advantech.com/en-tw/marketplace/help/technical-support for the official release of the fixed version.\u00a0\n\nFor here https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/JqNWAMGz1JQ .\u00a0\n\nFor here https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/G0yWBn2mp2q .", "supportingMedia": [{"type": "text/html", "value": "Users and administrators of affected product versions are advised to update to the latest versions immediately.\n\n<br>\n\n<p>For IoTSuite SaaSComposer<a target=\"_blank\" rel=\"nofollow\">, IoTSuite Growth Linux docker</a>, and <a target=\"_blank\" rel=\"nofollow\">IoT Edge Windows</a> please contact Advantech <a target=\"_blank\" rel=\"nofollow\" href=\"https://wise-iot.advantech.com/en-tw/marketplace/help/technical-support\">here </a>for the official release of the fixed version. </p><p>For <a target=\"_blank\" rel=\"nofollow\">IoTSuite Starter Linux docker</a>, please download the update <a target=\"_blank\" rel=\"nofollow\" href=\"https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/JqNWAMGz1JQ?tenantId=VGVuYW50.aSUET6-KO-0qXOBh\">here</a>. </p><p>For <a target=\"_blank\" rel=\"nofollow\">IoT Edge Linux docker</a>, please download the update <a target=\"_blank\" rel=\"nofollow\" href=\"https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/G0yWBn2mp2q?tenantId=VGVuYW50.aSUET6-KO-0qXOBh\">here</a>.</p>", "base64": false}]}], "datePublic": "2026-01-12T02:21:00.000Z", "references": [{"url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001/"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet.", "supportingMedia": [{"type": "text/html", "value": "Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet.", "base64": false}]}], "providerMetadata": {"orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4", "shortName": "CSA", "dateUpdated": "2026-01-12T09:20:30.502Z"}}}, "cveMetadata": {"cveId": "CVE-2025-52694", "state": "PUBLISHED", "dateUpdated": "2026-01-12T14:31:52.735Z", "dateReserved": "2025-06-19T06:04:41.987Z", "assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4", "datePublished": "2026-01-12T02:27:16.744Z", "assignerShortName": "CSA"}, "dataVersion": "5.2"}