SQL Injection Risk in Advantech WebAccess/VPN Affecting Multiple Versions
CVE-2025-34244

5.3MEDIUM

Key Information:

Vendor

Advantech
Status
Webaccess/vpn
Vendor
CVE Published:
6 November 2025

What is CVE-2025-34244?

The Advantech WebAccess/VPN prior to version 1.1.5 is susceptible to a SQL injection vulnerability that can be exploited by authenticated low-privileged users. This occurs through the AjaxFwRulesController.ajaxDeviceFwRulesAction() method, where an attacker can manipulate the datatable search parameters to execute arbitrary SQL queries. As a result, this flaw may lead to unauthorized disclosure of sensitive database information, posing significant risks to data integrity and confidentiality.

Affected Version(s)

WebAccess/VPN 0 < 1.1.5

References

https://icr.advantech.com/support/router-models/download/...
vendor-advisorypatch
https://www.vulncheck.com/advisories/advantech-webaccess-...
third-party-advisory
https://icr.advantech.com/download/software
product

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Williams from Pellera Technologies
JSON
.
CVE-2025-34244 : SQL Injection Risk in Advantech WebAccess/VPN Affecting Multiple Versions