CVE-2025-34239 - Advantech WebAccess/VPN < 1.1.5 Command Injection in AppManagementController.appUpgradeAction()

Back Back to CVE browser

HIGH

Advantech WebAccess/VPN < 1.1.5 Command Injection in AppManagementController.appUpgradeAction()

Published Nov 6, 2025

8.6

HIGH

CVSS 4.0

EPSS 1.74%

Description

Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as the web server user (www-data) by supplying a crafted uploaded filename.

Affected products

Vendor Advantech Product WebAccess/VPN Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.1.5

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Advantech

WebAccess/VPN

unaffected

Version	Status	Constraints
0	affected	<1.1.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-38166
Advisory
https://icr.advantech.com/download/software
product
https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf
vendor-advisorypatchRelease Notes
https://www.vulncheck.com/advisories/advantech-webaccess-vpn-command-injection-in-appmanagementcontroller
third-party-advisoryThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-38166		Advisory
https://icr.advantech.com/download/software		product
https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf		vendor-advisorypatchRelease Notes
https://www.vulncheck.com/advisories/advantech-webaccess-vpn-command-injection-in-appmanagementcontroller		third-party-advisoryThird Party Advisory