CVE-2022-3323

CVE-2022-3323 is an SQL injection vulnerability in Advantech iView 5.7.04.6469, specifically within the ConfigurationServlet endpoint. An unauthenticated remote attacker can exploit this flaw by manipulating the column_value parameter in the setConfiguration action, bypassing existing security checks to perform SQL injection and potentially retrieve sensitive information like the iView admin password. This vulnerability is rated as High severity (CVSS 7.5), indicating a network-based attack with low complexity and high impact on confidentiality. Currently, there is no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not known to be actively exploited, with minimal community discussion or media coverage.