CVE-2025-58423: Advantech DeviceOn/iEdge DoS Vulnerability

CVE-2025-58423 Overview

CVE-2025-58423 is a path traversal vulnerability [CWE-22] affecting Advantech DeviceOn/iEdge. The flaw stems from insufficient sanitization of uploaded configuration files. An authenticated attacker can supply a specially crafted configuration file to traverse directories, read or write arbitrary files, or trigger a denial-of-service condition. Because the affected service runs as the local system account, successful exploitation grants attacker operations at the highest privilege level on the host. CISA published advisory ICSA-25-310-01 covering this issue in the industrial control systems ecosystem.

Critical Impact

Authenticated network attackers can read or write arbitrary files and cause denial-of-service under the local system account context, compromising the integrity and availability of industrial edge devices.

Affected Products

• Advantech DeviceOn/iEdge
• Industrial edge devices managed through DeviceOn/iEdge
• Deployments exposing the management interface to the network

Discovery Timeline

• 2025-11-06 - CVE-2025-58423 published to NVD
• 2025-11-21 - Last updated in NVD database

Technical Details for CVE-2025-58423

Vulnerability Analysis

The vulnerability resides in the configuration file upload handler of Advantech DeviceOn/iEdge. The application accepts user-supplied configuration data without performing adequate validation of path components or file content. An attacker with low-privilege authenticated access can craft input that escapes the intended directory boundary using traversal sequences. The handler then resolves the manipulated path and performs file operations outside the designated configuration directory. Because the underlying service executes as the local system account, every read, write, or overwrite operation inherits system-level privileges on the host operating system.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The configuration parser does not normalize input paths or enforce an allow-list of permitted destinations. Sequences such as parent-directory references are passed through to file system APIs unchecked. Combined with execution under the local system account, this design allows tampering with arbitrary files on the host.

Attack Vector

The attack vector is network-based and requires low privileges with no user interaction. An attacker authenticates to the DeviceOn/iEdge interface and submits a crafted configuration file through the upload functionality. By embedding traversal sequences in file path fields, the attacker redirects write operations to sensitive system locations. The same primitive supports reading protected files or overwriting binaries to achieve persistence or denial of service. See the CISA ICS Advisory ICSA-25-310-01 for vendor-supplied technical details.

Detection Methods for CVE-2025-58423

Indicators of Compromise

• Configuration file upload requests containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f.
• Unexpected file modifications under directories outside the DeviceOn/iEdge installation path, particularly in system directories.
• DeviceOn/iEdge service crashes, restarts, or hung worker processes indicating a denial-of-service attempt.
• New or modified files in system locations owned by the local system account but unrelated to legitimate DeviceOn/iEdge operations.

Detection Strategies

• Inspect web server and application logs for configuration upload endpoints receiving payloads with traversal patterns or absolute paths.
• Monitor file integrity on hosts running DeviceOn/iEdge, with particular focus on system directories and executable paths.
• Correlate authentication events with subsequent configuration upload activity to identify low-privilege accounts performing administrative file operations.

Monitoring Recommendations

• Enable verbose logging on the DeviceOn/iEdge management interface and forward logs to a centralized SIEM for retention and alerting.
• Alert on any process spawned by the DeviceOn/iEdge service writing to paths outside its installation directory.
• Track outbound network connections from edge hosts that follow configuration uploads, which may indicate post-exploitation activity.

How to Mitigate CVE-2025-58423

Immediate Actions Required

• Restrict network access to the DeviceOn/iEdge management interface using firewalls and segmentation, exposing it only to trusted administrative networks.
• Audit existing DeviceOn/iEdge user accounts and remove or rotate credentials for unused or low-trust accounts.
• Review configuration upload logs for evidence of traversal attempts since the system was deployed.
• Apply vendor-supplied updates as soon as they are available from Advantech.

Patch Information

Refer to the CISA ICS Advisory ICSA-25-310-01 and the Advantech contact page for current patch availability and remediation guidance. Operators should coordinate directly with Advantech support to obtain fixed versions for their deployment.

Workarounds

• Place the DeviceOn/iEdge interface behind a VPN or jump host to eliminate direct network exposure.
• Enforce strong authentication and the principle of least privilege for any account permitted to upload configuration files.
• Disable or restrict the configuration upload feature where operationally feasible until a patch is applied.
• Implement host-based file integrity monitoring on directories writable by the local system account.

# Example: restrict access to the DeviceOn/iEdge management port using iptables
# Replace <mgmt-subnet> and <port> with your environment-specific values
iptables -A INPUT -p tcp --dport <port> -s <mgmt-subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport <port> -j DROP