CVE-2025-62630: Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with…

PriorityP264critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

0.60%

44.5th percentile

Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
advantech	deviceon_iedge	<= 2.0.2	—

Detection & IOCsextracted from sources · hover to see the quote

→Detect upload of a specially crafted configuration file used to perform path traversal and achieve remote code execution with system-level permissions on Advantech DeviceOn/iEdge ↗
→Monitor for authenticated (low-privilege) remote file upload requests to DeviceOn/iEdge (version 2.0.2 and prior) that contain directory traversal sequences (e.g., '../') within configuration file content or filename fields ↗
→Alert on processes spawned with system-level permissions originating from the DeviceOn/iEdge web service process, which may indicate successful RCE via path traversal exploitation ↗

·CVE-2025-62630 affects Advantech DeviceOn/iEdge version 2.0.2 and prior only; the successor product DeviceOn is stated as not vulnerable. Detections should be scoped to legacy DeviceOn/iEdge deployments. ↗
·The vulnerability requires low-privilege authenticated access (PR:L) over the network (AV:N) with no user interaction, meaning any authenticated user account on the platform is a viable attacker. Credential monitoring and least-privilege enforcement are relevant compensating controls. ↗
·No known public exploitation specifically targeting CVE-2025-62630 has been reported to CISA at time of advisory publication. ↗
·Advantech has declared DeviceOn/iEdge end-of-life; no patch will be issued. Mitigation relies on network isolation, firewall segmentation, and migration to DeviceOn. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.