webaccess\/vpn vulnerabilities and fixes

Recent CVEs affecting webaccess\/vpn, with upgrade or downgrade steps. 12 tracked.

webaccess\/vpn has 12 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 12. Most recent: 2025-11-06. Highest priority: CVE-2025-34239 (score 44/100).

• CVE-2025-34239 HIGH 7.2 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementCont
• CVE-2025-34238 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClient
• CVE-2025-34240 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementControll
• CVE-2025-34241 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.
• CVE-2025-34242 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController
• CVE-2025-34243 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController
• CVE-2025-34244 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController
• CVE-2025-34245 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClie
• CVE-2025-34246 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationCont
• CVE-2025-34247 MEDIUM 6.5 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.ad
• CVE-2025-34236 MEDIUM 5.4 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via 
• CVE-2025-34237 MEDIUM 5.4 UPGRADE Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via 

FAQ

How do I fix webaccess\/vpn vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is webaccess\/vpn being exploited right now?

None of the tracked webaccess\/vpn CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which webaccess\/vpn CVE should I patch first?

CVE-2025-34239 currently ranks highest (44/100): Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementCont.

RSS feed for webaccess\/vpn · ← Back to latest CVEs