Advantech Webaccess/vpn vulnerabilities

12 CVEs affecting Advantech Webaccess/vpn, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-34247, published 2025-11-06.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2025-34239, published 2025-11-06. High severity, CVSS 7.2. EPSS: 1.7% chance of exploitation in the next 30 days. Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute…
CVE-2025-34238, published 2025-11-06. Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days. Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated…
CVE-2025-34247, published 2025-11-06. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low-privileged observer user to inject SQL…
CVE-2025-34246, published 2025-11-06. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated low-privileged observer user to inject…
CVE-2025-34245, published 2025-11-06. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authenticated low-privileged observer user to…
CVE-2025-34244, published 2025-11-06. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authenticated low-privileged observer user to…
CVE-2025-34243, published 2025-11-06. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privileged observer user to…
CVE-2025-34242, published 2025-11-06. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via…
CVE-2025-34241, published 2025-11-06. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated low-privileged observer user to inject…
CVE-2025-34240, published 2025-11-06. Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days. Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged observer user to inject…