Path Traversal Vulnerability in Advantech WebAccess/VPN Affects Network Administrators
CVE-2025-34238

6.9MEDIUM

Key Information:

Vendor

Advantech
Status
Webaccess/vpn
Vendor
CVE Published:
6 November 2025

What is CVE-2025-34238?

Advantech WebAccess/VPN prior to version 1.1.5 is susceptible to a path traversal vulnerability. This issue arises from the AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() function, which can be exploited by an authenticated network administrator. This flaw allows them to access and retrieve the contents of arbitrary files that the web user (www-data) has permission to access, potentially leading to unauthorized disclosure of sensitive information.

Affected Version(s)

WebAccess/VPN 0 < 1.1.5

References

https://icr.advantech.com/support/router-models/download/...
vendor-advisorypatch
https://www.vulncheck.com/advisories/advantech-webaccess-...
third-party-advisory
https://icr.advantech.com/download/software
product

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Williams from Pellera Technologies
JSON
.
CVE-2025-34238 : Path Traversal Vulnerability in Advantech WebAccess/VPN Affects Network Administrators