QwikSec

Security Database

CVE

CWE

Training

CVE-2025-34237

Published: Nov 6, 2025

Modified: Nov 17, 2025

PUBLISHED

Description

Advantech WebAccess/VPN versions prior to 1.1.5 contain a stored cross-site scripting (XSS) vulnerability via StandaloneVpnClientsController.addStandaloneVpnClientAction(). Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser.

Vendor	Product	Versions
Advantech	WebAccess/VPN	affected `0 - < 1.1.5`

Weaknesses (CWE)

References

https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf

vendor-advisory

patch

https://www.vulncheck.com/advisories/advantech-webaccess-vpn-stored-xss-via-standalonevpnclientscontroller

third-party-advisory

https://icr.advantech.com/download/software

product

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.