Advantech Deviceon Iedge vulnerabilities

CVE-2025-59171 [CRITICAL] CWE-22 CVE-2025-59171: Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions.

CVE-2025-62630 [CRITICAL] CWE-22 CVE-2025-62630: Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions.

CVE-2025-58423 [HIGH] CWE-22 CVE-2025-58423: Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories, or read/write files, within the context of the local system account.

CVE-2021-40389 [HIGH] CWE-276 CVE-2021-40389: A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1 A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM authority. An attacker can provide a malicious file to trigger this vulnerability.

CVE-2025-64302 [MEDIUM] CWE-79 CVE-2025-64302: Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a d Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosure or data manipulation.