CVE-2025-52694 (CVSS 10): Critical Advantech SQL Injection Exposes IoT Devices

CVE-2025-52694 is a SQL injection flaw in Advantech’s IoT product line that carries a CVSS score of 10.0, marking it as a critical threat that requires immediate attention from administrators. According to CSA Singapore, successful exploitation allows an unauthenticated remote attacker to execute arbitrary SQL commands, meaning that if a vulnerable service is exposed to the Internet, no username or password is required to strike.

The vulnerability affects several components of Advantech’s IoT ecosystem, including IoTSuite SaaSComposer (versions prior to 3.4.15) and multiple IoTSuite Docker and IoT Edge products with versions prior to V2.0.2, while updates are available via manual requests or direct downloads through Advantech’s official channels. The flaw was discovered by Mr. Loi Nguyen Thang of the HCMUTE Information Security Club, who collaborated with Advantech and CSA on coordinated disclosure. Administrators are urged to update to the latest versions to close the security gap.