CVE-2025-41442 Advantech iView Cross-site Scripting
Attackers can execute unauthorized scripts in user browsers via reflected XSS in Advantech iView, leading to information disclosure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2025-41442?
CVE-2025-41442 is a medium-severity cross-site scripting vulnerability in Advantech iView, published on 10 Jul 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability exists in Advantech iView versions prior to 5.7.05 build 7057, which could allow a reflected cross-site scripting (XSS) attack. By manipulating certain input parameters, an attacker could execute unauthorized scripts in the user's browser, potentially leading to information disclosure or other malicious activities.
Weakness: CWE-79
Which versions are affected by CVE-2025-41442?
It affects 1 product.
Products include Advantech Iview.
How do I fix CVE-2025-41442?
No fix has been published for CVE-2025-41442 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2025-41442 being exploited?
There is no known exploitation of CVE-2025-41442 in the wild and no public exploit code.
Other vulnerabilities in Advantech iView
Sources
Also known as GHSA-9h6g-gh32-jqrj.