SQL Injection Vulnerability in Advantech WebAccess/VPN Product
CVE-2025-34241

5.3MEDIUM

Key Information:

Vendor

Advantech
Status
Webaccess/vpn
Vendor
CVE Published:
6 November 2025

What is CVE-2025-34241?

A SQL injection vulnerability exists in Advantech WebAccess/VPN versions prior to 1.1.5 within the AjaxDeviceController.ajaxDeviceAction() function. This flaw allows authenticated low-privileged users to inject malicious SQL via data table search parameters, potentially exposing sensitive database information.

Affected Version(s)

WebAccess/VPN 0 < 1.1.5

References

https://icr.advantech.com/support/router-models/download/...
vendor-advisorypatch
https://www.vulncheck.com/advisories/advantech-webaccess-...
third-party-advisory
https://icr.advantech.com/download/software
product

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Williams from Pellera Technologies
JSON
.
CVE-2025-34241 : SQL Injection Vulnerability in Advantech WebAccess/VPN Product