CVE-2025-52694

critical · 10

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet, potentially affecting data confidentiality, integrity, and availability. Users and administrators of affected product versions are advised to update to the latest versions immediately.

CVSS

40.4%

EPSS (exploit prob.)

99th

EPSS percentile

2026-01-12

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-89

Affected products

Vendor	Product	Affected versions
advantech	iot_edge_linux_docker	< 2.0.2
advantech	iot_edge_windows	< 2.0.2
advantech	iotsuite_growth_linux_docker	< 2.0.2
advantech	iotsuite_saas_composer	< 3.4.15
advantech	iotsuite_starter_linux_docker	< 2.0.2

Check a specific version with /api/v1/cve/match.

References

https://www.csa.gov.sg/alerts-and-advisories/alerts/alerts-al-2026-001/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-52694