Advantech Deviceon/iedge vulnerabilities

5 CVEs affecting Advantech Deviceon/iedge, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-64302, published 2025-11-06.

More from Advantech.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-59171, published 2025-11-06. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions.
• CVE-2025-62630, published 2025-11-06. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to traverse directories and achieve remote code execution with system-level permissions.
• CVE-2025-58423, published 2025-11-06. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. Due to insufficient sanitization, an attacker can upload a specially crafted configuration file to cause a denial-of-service condition, traverse directories, or read/write files, within the context…
• CVE-2021-40389, published 2022-01-28. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. A privilege escalation vulnerability exists in the installation of Advantech DeviceOn/iEdge Server 1.0.2. A specially-crafted file can be replaced in the system to escalate privileges to NT SYSTEM…
• CVE-2025-64302, published 2025-11-06. Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days. Insufficient input sanitization in the dashboard label or path can allow an attacker to trigger a device error causing information disclosure or data manipulation.