← Database

CVE-2025-34243

MEDIUM CVSS: 6.5 Published: 2025-11-06 Modified: 2026-06-17

Description

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

Affected Platforms

Advantech Webaccess\/Vpn

Weakness Type

CWE-89

References