Stored Cross-Site Scripting Vulnerability in Advantech WebAccess/VPN
CVE-2025-34237

6.3MEDIUM

Key Information:

Vendor

Advantech
Status
Webaccess/vpn
Vendor
CVE Published:
6 November 2025

What is CVE-2025-34237?

The Advantech WebAccess/VPN, specifically versions earlier than 1.1.5, is susceptible to a stored cross-site scripting vulnerability. This flaw arises from inadequate validation or escaping of user-supplied input through the StandaloneVpnClientsController.addStandaloneVpnClientAction() method. An attacker could exploit this vulnerability to inject malicious scripts that are executed within the victim's browser context, potentially compromising user data and overall system security.

Affected Version(s)

WebAccess/VPN 0 < 1.1.5

References

https://icr.advantech.com/support/router-models/download/...
vendor-advisorypatch
https://www.vulncheck.com/advisories/advantech-webaccess-...
third-party-advisory
https://icr.advantech.com/download/software
product

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Williams from Pellera Technologies
JSON
.
CVE-2025-34237 : Stored Cross-Site Scripting Vulnerability in Advantech WebAccess/VPN