Loading vulnerability…
CVE-2025-52694 is an unauthenticated SQL injection vulnerability in Advantech WISE-IoTSuite/SaaS Composer (Advantech IoT product line). The injection is reported to be reachable via the filename parameter in requests matching the path pattern /displays/{filename}?org_id={integer}. When the vulnerable service is exposed to the Internet, a remote attacker can exploit the flaw without credentials to execute arbitrary SQL commands against the backend database (e.g., demonstrated via time-based SQLi with an observed ~6-second delay).
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository provides proof-of-concept (PoC) tools for exploiting CVE-2025-52694, a critical unauthenticated SQL injection vulnerability in Advantech IoTSuite SaaSComposer and related IoT Edge products. The vulnerability exists in the /displays/{filename}.json?org_id= HTTP endpoint, where the 'filename' parameter is unsafely concatenated into a PostgreSQL query, allowing attackers to inject arbitrary SQL, including stacked queries. The repository contains three files: a detailed README.md describing the vulnerability and usage, a Python script (cve-2025-52694-poc.py) that performs a time-based SQL injection test using the pg_sleep() function, and a Nuclei YAML template (cve-2025-52694.yaml) for automated scanning. The exploit is unauthenticated and network-based, targeting specific Advantech product versions prior to their respective patched releases. The PoC demonstrates the ability to confirm the vulnerability via response timing, with potential for further exploitation such as data exfiltration or remote code execution depending on database privileges. No fake or destructive code is present; the repository is a legitimate PoC for security testing and research.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated remote SQL injection vulnerability in Advantech IoT products that allows execution of arbitrary SQL commands, potentially enabling data theft, configuration tampering, and broader compromise of connected IoT infrastructure.
An unauthenticated SQL injection vulnerability in Advantech WISE-IoTSuite/SaaS Composer reachable via the /displays/{filename} endpoint (filename parameter), allowing SQL injection without authentication.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.