CVE-2025-34238
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web user (www-data) can access.
Risk Assessment
An authenticated network administrator can read arbitrary files accessible to the www-data user, potentially leading to disclosure of sensitive information such as configuration files or credentials.
Recommendation
Update Advantech WebAccess/VPN to version 1.1.5 or later. Restrict administrative access to trusted users.
Other vulnerabilities in Advantech WebAccess/VPN
See all- CVE-2025-34247Medium
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
- CVE-2025-34246Medium
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction(), allowing an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
- CVE-2025-34245Medium
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction(), allowing an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
- CVE-2025-34244Medium
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction(), allowing an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
- CVE-2025-34243Medium
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction(), allowing an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
- CVE-2025-34242Medium
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction(), allowing an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
- CVE-2025-34241Medium
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction(), allowing an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
- CVE-2025-34240Medium
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction(), allowing an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
- CVE-2025-34239High
Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction(). An authenticated system administrator can execute arbitrary commands as the web server user (www-data) by supplying a crafted uploaded filename.
- CVE-2025-34237Medium
Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.
Original NVD description (English source)
Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to cause the application to read and return the contents of arbitrary files the web user (www-data) can access.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS