The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute a

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• advantech iviewbefore 5.7.04.6469

Versions reported by the vendor

Affected version ranges reported by the assigning authority (icscert). Independent of NVD's CPE analysis and usually ahead of it.

• Advantech iView iView

  • All and later · before 5_7_04_6469affected

Other highest-scoring records for the same primary product.

• CVE-2022-2143The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.
  57Plan
• CVE-2021-22652Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attac
  50Plan
• CVE-2022-2139The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and execute arbitrary co
  44Plan
• CVE-2021-22658Advantech iView versions prior to v5.7.03.6112 are vulnerable to a SQL injection, which may allow an attacker to escalate privileges to 'Adm
  43Plan
• CVE-2021-32930The affected product’s configuration is vulnerable due to missing authentication, which may allow an attacker to change configurations and e
  41Plan
• CVE-2020-16245Advantech iView, Versions 5.7 and prior.
  41Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

A function added for development or support ships to production without authentication. It often relies on the assumption that it is “only reachable from the internal network.”

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1// Added for the support team2app.post("/maintenance/reset", resetDevice);

1if (config.maintenanceEnabled) {2  app.post(3    "/maintenance/reset",4    requireSession, requireRole("admin"), resetDevice5  );6}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.