8.6Yüksek
CVE-2025-34240Advantech WebAccess/VPN < 1.1.5 SQL Injection via AppManagementController.appUpgradeAction()
Açıklama
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.
Zayıflık türü (CWE):
CWE-89
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| Advantech | WebAccess/VPN | < 1.1.5 |
Kaynaklar ve yamalar
- https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf vendor-advisorypatchRelease Notes
- https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-appmanagementcontroller-appupgradeaction third-party-advisoryThird Party Advisory
- https://icr.advantech.com/download/software productProduct
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:advantech:webaccess\/vpn:*:*:*:*:*:*:*:*< 1.1.5