CVE-2025-52694 CRITICAL

CVE-2025-52694: Execution of arbitrary SQL commands

Vendor Advantech
Product IoTSuite and IoT Edge Products
Published January 12, 2026
Last update January 26, 2026

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet, potentially affecting data confidentiality, integrity, and availability. Users and administrators of affected product versions are advised to update to the latest versions immediately.

Key dates

02Disclosure timeline

January 12, 2026 CVE published
January 26, 2026 Record updated