Is CVE-2023-52335 actively exploited?

No active exploitation of CVE-2023-52335 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2023-52335 be exploited remotely?

Yes. CVE-2023-52335 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2023-52335?

CVE-2023-52335 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2023-52335

HIGH

CVE-2023-52335

CWE-89Published: November 22, 2024· Updated: Jun 17, 2026

7.5

CVSS v3.1

Official Description

Advantech iView ConfigurationServlet SQL Injection Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the ConfigurationServlet servlet, which listens on TCP port 8080 by default. When parsing the column_value element, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-17863.

NVD Source

Technical Analysis

CVE-2023-52335 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.

From a weakness classification perspective (CWE-89): SQL injection vulnerabilities allow attackers to manipulate database queries, potentially exposing or modifying sensitive data.