CVE-2025-62630: Advantech DeviceOn/iEdge RCE Vulnerability

CVE-2025-62630 Overview

CVE-2025-62630 is a path traversal vulnerability in Advantech DeviceOn/iEdge that allows attackers to upload specially crafted configuration files to traverse directories and achieve remote code execution with system-level permissions. Due to insufficient sanitization of file paths during configuration file uploads, an authenticated attacker can escape intended directory boundaries and write malicious files to arbitrary locations on the target system.

Critical Impact

This vulnerability enables authenticated attackers to achieve remote code execution with SYSTEM privileges on affected Advantech DeviceOn/iEdge installations, potentially leading to complete system compromise of industrial edge computing devices.

Affected Products

• Advantech DeviceOn/iEdge (all versions prior to patch)
• Industrial IoT edge computing platforms running DeviceOn/iEdge software
• Connected OT/ICS environments utilizing Advantech device management solutions

Discovery Timeline

• November 6, 2025 - CVE-2025-62630 published to NVD
• November 19, 2025 - Last updated in NVD database

Technical Details for CVE-2025-62630

Vulnerability Analysis

This vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as Path Traversal or Directory Traversal. The flaw exists in the configuration file upload functionality of Advantech DeviceOn/iEdge, where user-supplied file paths are not properly validated before being used in file operations.

When processing configuration file uploads, the application fails to adequately sanitize path components containing directory traversal sequences such as ../ or ..\. An attacker with low-privilege access can craft malicious configuration files containing these sequences, allowing them to write content outside the intended upload directory and into sensitive system locations.

The vulnerability is particularly dangerous because DeviceOn/iEdge typically runs with elevated system privileges, meaning any code execution achieved through file write operations inherits those same high-level permissions.

Root Cause

The root cause of CVE-2025-62630 is insufficient input sanitization within the configuration file upload handler. The application does not properly validate or canonicalize file paths before using them in file system operations. Specifically, the upload functionality lacks:

• Proper validation of path traversal sequences (../, ..\)
• Canonicalization of paths to their absolute form before validation
• Restriction of uploads to a whitelisted directory structure
• Adequate input filtering for special characters in filenames

This allows attackers to escape the intended upload directory and place files in arbitrary locations on the file system.

Attack Vector

The attack can be executed remotely over the network by an authenticated user with low privileges. The exploitation flow involves:

1. An attacker authenticates to the DeviceOn/iEdge management interface with valid credentials
2. The attacker crafts a configuration file with a malicious filename containing path traversal sequences
3. The attacker uploads the malicious configuration file through the vulnerable upload functionality
4. The application processes the filename without proper sanitization
5. The file is written to a location controlled by the attacker (outside intended directories)
6. By writing executable content or scripts to system startup locations, the attacker achieves code execution with system-level permissions

The attack requires no user interaction beyond the initial authentication and does not require complex exploitation techniques, making it accessible to attackers with basic knowledge of path traversal vulnerabilities.

Detection Methods for CVE-2025-62630

Indicators of Compromise

• Unexpected files appearing in system directories such as startup folders, scheduled task directories, or web application roots
• Configuration files containing path traversal sequences (../, ..\) in upload logs
• Anomalous process execution originating from the DeviceOn/iEdge service
• Unauthorized modifications to system files or new executable files outside of normal application directories

Detection Strategies

• Monitor file write operations from DeviceOn/iEdge processes for attempts to write outside designated configuration directories
• Implement file integrity monitoring (FIM) on critical system directories to detect unauthorized file creation
• Review web server and application logs for requests containing path traversal patterns in filenames
• Deploy network-based detection rules to identify uploads containing ../ or encoded traversal sequences

Monitoring Recommendations

• Enable verbose logging for the DeviceOn/iEdge configuration upload functionality
• Configure SIEM rules to alert on file system operations attempting to access parent directories from application contexts
• Implement endpoint detection and response (EDR) monitoring for new executables or scripts in system startup locations
• Conduct regular audits of files in sensitive directories for unauthorized or unexpected content

How to Mitigate CVE-2025-62630

Immediate Actions Required

• Review the CISA ICS Advisory ICSA-25-310-01 for official guidance and available patches
• Restrict network access to DeviceOn/iEdge management interfaces to trusted networks only
• Implement strong authentication and review user privileges to minimize exposure
• Monitor for indicators of compromise in affected environments

Patch Information

Advantech has been notified of this vulnerability. Administrators should consult the CISA ICS Advisory for the latest patch availability and installation instructions. Contact Advantech Support directly for vendor-specific remediation guidance and to obtain security updates.

Organizations should prioritize patching this vulnerability due to its potential for system-level compromise in industrial and operational technology environments.

Workarounds

• Isolate DeviceOn/iEdge systems on segmented network zones with strict access controls until patches can be applied
• Implement application-layer firewalls or web application firewalls (WAF) to filter requests containing path traversal sequences
• Disable or restrict access to the configuration file upload functionality if not operationally required
• Deploy additional monitoring and file integrity controls on critical system directories

# Example: Restrict access to DeviceOn/iEdge management interface via iptables
# Allow only specific management IP ranges to access the service
iptables -A INPUT -p tcp --dport 443 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP