Vulnerability-Lookup

CVE-2025-52694 (GCVE-0-2025-52694)

Vulnerability from cvelistv5 – Published: 2026-01-12 02:27 – Updated: 2026-01-12 14:31

Title

Execution of arbitrary SQL commands

Summary

Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet.

Severity ?

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

CSA

References

URL

Tags

https://www.csa.gov.sg/alerts-and-advisories/aler…

Impacted products

	Vendor	Product	Version
	Advantech	IoTSuite and IoT Edge Products	Affected: IoTSuite SaaSComposer prior to version 3.4.15 Affected: IoTSuite Growth Linux docker prior to version V2.0.2 Affected: IoTSuite Starter Linux docker prior to version V2.0.2 Affected: IoT Edge Linux docker prior to version V2.0.2 Affected: IoT Edge Windows prior to version V2.0.2

Credits

Loi Nguyen Thang

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-52694",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-01-12T14:31:37.398331Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-89",
                "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-01-12T14:31:52.735Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "IoTSuite and IoT Edge Products",
          "vendor": "Advantech",
          "versions": [
            {
              "status": "affected",
              "version": "IoTSuite SaaSComposer prior to version 3.4.15"
            },
            {
              "status": "affected",
              "version": "IoTSuite Growth Linux docker prior to version V2.0.2"
            },
            {
              "status": "affected",
              "version": "IoTSuite Starter Linux docker prior to version V2.0.2"
            },
            {
              "status": "affected",
              "version": "IoT Edge Linux docker prior to version V2.0.2"
            },
            {
              "status": "affected",
              "version": "IoT Edge Windows prior to version V2.0.2"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Loi Nguyen Thang"
        }
      ],
      "datePublic": "2026-01-12T02:21:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet."
            }
          ],
          "value": "Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-01-12T09:20:30.502Z",
        "orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
        "shortName": "CSA"
      },
      "references": [
        {
          "url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001/"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Users and administrators of affected product versions are advised to update to the latest versions immediately.\n\n\u003cbr\u003e\n\n\u003cp\u003eFor IoTSuite SaaSComposer\u003ca target=\"_blank\" rel=\"nofollow\"\u003e, IoTSuite Growth Linux docker\u003c/a\u003e, and \u003ca target=\"_blank\" rel=\"nofollow\"\u003eIoT Edge Windows\u003c/a\u003e\u0026nbsp;please contact Advantech \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://wise-iot.advantech.com/en-tw/marketplace/help/technical-support\"\u003ehere \u003c/a\u003efor the official release of the fixed version.\u0026nbsp;\u003c/p\u003e\u003cp\u003eFor \u003ca target=\"_blank\" rel=\"nofollow\"\u003eIoTSuite Starter Linux docker\u003c/a\u003e, please download the update \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/JqNWAMGz1JQ?tenantId=VGVuYW50.aSUET6-KO-0qXOBh\"\u003ehere\u003c/a\u003e.\u0026nbsp;\u003c/p\u003e\u003cp\u003eFor \u003ca target=\"_blank\" rel=\"nofollow\"\u003eIoT Edge Linux docker\u003c/a\u003e, please download the update \u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/G0yWBn2mp2q?tenantId=VGVuYW50.aSUET6-KO-0qXOBh\"\u003ehere\u003c/a\u003e.\u003c/p\u003e"
            }
          ],
          "value": "Users and administrators of affected product versions are advised to update to the latest versions immediately.\n\n\n\n\nFor IoTSuite SaaSComposer here  https://wise-iot.advantech.com/en-tw/marketplace/help/technical-support for the official release of the fixed version.\u00a0\n\nFor  here https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/JqNWAMGz1JQ .\u00a0\n\nFor  here https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/G0yWBn2mp2q ."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Execution of arbitrary SQL commands",
      "x_generator": {
        "engine": "Vulnogram 0.5.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
    "assignerShortName": "CSA",
    "cveId": "CVE-2025-52694",
    "datePublished": "2026-01-12T02:27:16.744Z",
    "dateReserved": "2025-06-19T06:04:41.987Z",
    "dateUpdated": "2026-01-12T14:31:52.735Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-52694\",\"sourceIdentifier\":\"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4\",\"published\":\"2026-01-12T03:16:07.127\",\"lastModified\":\"2026-01-12T15:16:03.463\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"references\":[{\"url\":\"https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001/\",\"source\":\"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-52694\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-12T14:31:37.398331Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-89\", \"description\": \"CWE-89 Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-12T14:31:49.132Z\"}}], \"cna\": {\"title\": \"Execution of arbitrary SQL commands\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Loi Nguyen Thang\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 10, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Advantech\", \"product\": \"IoTSuite and IoT Edge Products\", \"versions\": [{\"status\": \"affected\", \"version\": \"IoTSuite SaaSComposer prior to version 3.4.15\"}, {\"status\": \"affected\", \"version\": \"IoTSuite Growth Linux docker prior to version V2.0.2\"}, {\"status\": \"affected\", \"version\": \"IoTSuite Starter Linux docker prior to version V2.0.2\"}, {\"status\": \"affected\", \"version\": \"IoT Edge Linux docker prior to version V2.0.2\"}, {\"status\": \"affected\", \"version\": \"IoT Edge Windows prior to version V2.0.2\"}], \"defaultStatus\": \"unknown\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Users and administrators of affected product versions are advised to update to the latest versions immediately.\\n\\n\\n\\n\\nFor IoTSuite SaaSComposer here  https://wise-iot.advantech.com/en-tw/marketplace/help/technical-support for the official release of the fixed version.\\u00a0\\n\\nFor  here https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/JqNWAMGz1JQ .\\u00a0\\n\\nFor  here https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/G0yWBn2mp2q .\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Users and administrators of affected product versions are advised to update to the latest versions immediately.\\n\\n\u003cbr\u003e\\n\\n\u003cp\u003eFor IoTSuite SaaSComposer\u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\"\u003e, IoTSuite Growth Linux docker\u003c/a\u003e, and \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\"\u003eIoT Edge Windows\u003c/a\u003e\u0026nbsp;please contact Advantech \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://wise-iot.advantech.com/en-tw/marketplace/help/technical-support\\\"\u003ehere \u003c/a\u003efor the official release of the fixed version.\u0026nbsp;\u003c/p\u003e\u003cp\u003eFor \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\"\u003eIoTSuite Starter Linux docker\u003c/a\u003e, please download the update \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/JqNWAMGz1JQ?tenantId=VGVuYW50.aSUET6-KO-0qXOBh\\\"\u003ehere\u003c/a\u003e.\u0026nbsp;\u003c/p\u003e\u003cp\u003eFor \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\"\u003eIoT Edge Linux docker\u003c/a\u003e, please download the update \u003ca target=\\\"_blank\\\" rel=\\\"nofollow\\\" href=\\\"https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/G0yWBn2mp2q?tenantId=VGVuYW50.aSUET6-KO-0qXOBh\\\"\u003ehere\u003c/a\u003e.\u003c/p\u003e\", \"base64\": false}]}], \"datePublic\": \"2026-01-12T02:21:00.000Z\", \"references\": [{\"url\": \"https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001/\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.5.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet.\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4\", \"shortName\": \"CSA\", \"dateUpdated\": \"2026-01-12T09:20:30.502Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-52694\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-12T14:31:52.735Z\", \"dateReserved\": \"2025-06-19T06:04:41.987Z\", \"assignerOrgId\": \"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4\", \"datePublished\": \"2026-01-12T02:27:16.744Z\", \"assignerShortName\": \"CSA\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-52694

Vulnerability from fkie_nvd - Published: 2026-01-12 03:16 - Updated: 2026-01-12 15:16

Severity ?

10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Summary

References

	URL	Tags
	5f57b9bf-260d-4433-bf07-b6a79e9bb7d4	https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet."
    }
  ],
  "id": "CVE-2025-52694",
  "lastModified": "2026-01-12T15:16:03.463",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 10.0,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 6.0,
        "source": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-01-12T03:16:07.127",
  "references": [
    {
      "source": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
      "url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001/"
    }
  ],
  "sourceIdentifier": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}

GHSA-77R3-GHGF-32GR

Vulnerability from github – Published: 2026-01-12 03:31 – Updated: 2026-01-12 03:31

Details

Severity ?

10.0 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-52694"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-01-12T03:16:07Z",
    "severity": "CRITICAL"
  },
  "details": "Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet.",
  "id": "GHSA-77r3-ghgf-32gr",
  "modified": "2026-01-12T03:31:07Z",
  "published": "2026-01-12T03:31:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-52694"
    },
    {
      "type": "WEB",
      "url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-127"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2025-52694 (GCVE-0-2025-52694)

FKIE_CVE-2025-52694

GHSA-77R3-GHGF-32GR

Tags

Sightings

Nomenclature