CVE-2022-2143: Advantech iView command injection in NetworkServlet

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit code available, and a very high EPSS score make this an urgent patching priority.

What it is

Advantech iView contains two command injection flaws (CWE-77) that let an attacker run arbitrary commands on the host. The vulnerability is remotely reachable with no authentication or user interaction, and a public exploit exists, so it is a serious risk for any exposed iView instance.

Impact

An unauthenticated remote attacker can execute arbitrary code with the privileges of the iView service, leading to full compromise of the affected host.

Attack surface

Reached over the network via the iView NetworkServlet HTTP interface; the CVSS vector (AV:N/PR:N/UI:N) indicates no authentication or user interaction is required.

Exploitation

Not listed in CISA KEV, but EPSS is 0.594 (99th percentile) and public exploit code is referenced on Packet Storm, indicating active interest and readily available exploitation.

What to do

• Apply the vendor fix referenced in CISA ICS advisory ICSA-22-179-03 as the first action.
• Restrict network access to the iView web interface to trusted management networks only.
• Do not expose iView directly to the internet; place it behind a firewall or VPN.
• Monitor and review logs for unexpected command execution or unusual child processes spawned by the iView service.
• If patching is not immediately possible, isolate affected systems until remediation is complete.

Detection

• Inspect web server and application logs for suspicious requests to NetworkServlet endpoints.
• Monitor for unexpected child processes (cmd.exe, /bin/sh) spawned by the iView service.
• Alert on outbound network connections from iView hosts to unknown destinations.
• Use file integrity monitoring on iView installation directories to catch dropped payloads.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.