{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-6888", "assignerOrgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4", "state": "PUBLISHED", "assignerShortName": "CSA", "dateReserved": "2026-04-23T02:58:12.750Z", "datePublished": "2026-05-13T03:16:24.701Z", "dateUpdated": "2026-05-13T14:35:53.880Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "5f57b9bf-260d-4433-bf07-b6a79e9bb7d4", "shortName": "CSA", "dateUpdated": "2026-05-13T03:16:24.701Z" }, "title": "SQL Injection Vulnerability", "datePublic": "2026-05-13T02:54:00.000Z", "affected": [ { "vendor": "Advantech", "product": "SaaS Composer", "versions": [ { "status": "affected", "version": "prior to version 3.4.17" } ], "defaultStatus": "unknown" }, { "vendor": "Advantech", "product": "IoTSuite Growth Linux docker", "versions": [ { "status": "affected", "version": "prior to version 2.2.0" } ], "defaultStatus": "unknown" }, { "vendor": "Advantech", "product": "IoTSuite Starter Linux docker", "versions": [ { "status": "affected", "version": "prior to version 2.2.0" } ], "defaultStatus": "unknown" }, { "vendor": "Advantech", "product": "IoT Edge Linux docker", "versions": [ { "status": "affected", "version": "prior to version 2.2.0" } ], "defaultStatus": "unknown" }, { "vendor": "Advantech", "product": "IoT Edge Windows", "versions": [ { "status": "affected", "version": "prior to version 2.2.0" } ], "defaultStatus": "unknown" }, { "vendor": "Advantech", "product": "WebAccess/SCADA", "versions": [ { "status": "affected", "version": "prior to version 9.2.3" } ], "defaultStatus": "unknown" }, { "vendor": "Advantech", "product": "WebAccess SaaS-Composer", "versions": [ { "status": "affected", "version": "prior to version 3.4.17.1" } ], "defaultStatus": "unknown" }, { "vendor": "Advantech", "product": "ECOWatch SaaS-Composer", "versions": [ { "status": "affected", "version": "prior to version 3.4.17" } ], "defaultStatus": "unknown" } ], "descriptions": [ { "lang": "en", "value": "Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to\nexecute arbitrary commands via a specific interface,\npotentially enabling the attacker to access, modify, or delete sensitive\ninformation within the database.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

Successful exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to\nexecute arbitrary commands via a specific interface,\npotentially enabling the attacker to access, modify, or delete sensitive\ninformation within the database.

" } ] } ], "references": [ { "url": "https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-050/" } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV3_1": { "version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H" } } ], "solutions": [ { "lang": "en", "value": "Users and administrators of\naffected product versions are advised to update to the latest versions\nimmediately.\n\n\n\n\n\nFor SaaS Composer, IoTSuite Growth\nLinux docker, IoT Edge Windows, and ECOWatch please contact Advantech  here  https://wise-iot.advantech.com/en-tw/marketplace/help/technical-support for\nthe official release of the fixed version.\n\n\n\n\n\nFor IoTSuite Starter Linux docker,\nplease refer to the update guide  here https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/oPN5exOVNQq .\nAs the update involves a reinstallation process, please refer to the\nreinstallation guide here https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/JqNWAMGz1JQ .\n\n\n\n\n\nFor IoT Edge Linux docker, please\nrefer to the update guide  here https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/oPN5exOVNQq .\nAs the update involves a reinstallation process, please refer to the\nreinstallation guide here https://portal-kbinsight-wiseiot-ensaas.practice.cloud.advantech.com/kb/library/detail/G0yWBn2mp2q .\n\n\n\n\n\nFor WebAccess/SCADA and WebAccess\nSaaS-Composer, please refer to the update guide here https://www.advantech.com/en/support/details/installation .", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "

Users and administrators of\naffected product versions are advised to update to the latest versions\nimmediately.

\n\n

For SaaS Composer, IoTSuite Growth\nLinux docker, IoT Edge Windows, and ECOWatch please contact Advantech here for\nthe official release of the fixed version.

\n\n

For IoTSuite Starter Linux docker,\nplease refer to the update guide here.\nAs the update involves a reinstallation process, please refer to the\nreinstallation guide here.

\n\n

For IoT Edge Linux docker, please\nrefer to the update guide here.\nAs the update involves a reinstallation process, please refer to the\nreinstallation guide here.

\n\n

For WebAccess/SCADA and WebAccess\nSaaS-Composer, please refer to the update guide here.

" } ] } ], "credits": [ { "lang": "en", "value": "Hoa Ly Van Huu", "type": "finder" } ], "source": { "discovery": "UNKNOWN" }, "x_generator": { "engine": "Vulnogram 1.0.2" } }, "adp": [ { "problemTypes": [ { "descriptions": [ { "type": "CWE", "cweId": "CWE-89", "lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')" } ] } ], "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-05-13T14:35:40.247452Z", "id": "CVE-2026-6888", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-13T14:35:53.880Z" } } ] } }