8.6Alta
CVE-2025-34239Advantech WebAccess/VPN < 1.1.5 Command Injection in AppManagementController.appUpgradeAction()
Descripción
Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as the web server user (www-data) by supplying a crafted uploaded filename.
Debilidad (CWE):
CWE-78
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| Advantech | WebAccess/VPN | < 1.1.5 |
Referencias y parches
- https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf vendor-advisorypatchRelease Notes
- https://www.vulncheck.com/advisories/advantech-webaccess-vpn-command-injection-in-appmanagementcontroller third-party-advisoryThird Party Advisory
- https://icr.advantech.com/download/software productProduct
Coincidencias CPE (NVD) (1)
cpe:2.3:a:advantech:webaccess\/vpn:*:*:*:*:*:*:*:*< 1.1.5