CVE-2025-53397

A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By exploiting this flaw, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or other malicious activities.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183	Product
https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:advantech:iview:*:*:*:*:*:*:*:*

History

01 Aug 2025, 19:19

Type	Values Removed	Values Added
References	~~() https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183 -~~	() https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183 - Product
References	~~() https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08 -~~	() https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08 - Third Party Advisory, US Government Resource
CPE		cpe:2.3:a:advantech:iview::::::::
First Time		Advantech iview Advantech

15 Jul 2025, 13:14

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad en las versiones de Advantech iView anteriores a la 5.7.05, compilación 7057, que podría permitir un ataque de cross-site scripting (XSS) reflejado. Al explotar esta vulnerabilidad, un atacante podría ejecutar scripts no autorizados en el navegador del usuario, lo que podría provocar la divulgación de información u otras actividades maliciosas.

11 Jul 2025, 00:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-07-11 00:15

Updated : 2025-08-01 19:19

NVD link : CVE-2025-53397

Mitre link : CVE-2025-53397

CVE.ORG link : CVE-2025-53397

JSON object : View

Products Affected

advantech

iview

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-53397", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-07-11T00:15:26.763", "references": [{"url": "https://www.advantech.com/en/support/details/firmware-?id=1-HIPU-183", "tags": ["Product"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-191-08", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in Advantech iView versions prior to 5.7.05 build\n 7057, which could allow a reflected cross-site scripting (XSS) attack. \nBy exploiting this flaw, an attacker could execute unauthorized scripts \nin the user's browser, potentially leading to information disclosure or \nother malicious activities."}, {"lang": "es", "value": "Existe una vulnerabilidad en las versiones de Advantech iView anteriores a la 5.7.05, compilaci\u00f3n 7057, que podr\u00eda permitir un ataque de cross-site scripting (XSS) reflejado. Al explotar esta vulnerabilidad, un atacante podr\u00eda ejecutar scripts no autorizados en el navegador del usuario, lo que podr\u00eda provocar la divulgaci\u00f3n de informaci\u00f3n u otras actividades maliciosas."}], "lastModified": "2025-08-01T19:19:25.320", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:advantech:iview:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7D3E520F-CCCE-46E1-A8ED-95E10597DF43", "versionEndExcluding": "5.7.05.7057"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}