QwikSec

Security Database

CVE

CWE

Training

CVE-2025-34239

Published: Nov 6, 2025

Modified: Nov 17, 2025

PUBLISHED

Description

Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as the web server user (www-data) by supplying a crafted uploaded filename.

Vendor	Product	Versions
Advantech	WebAccess/VPN	affected `0 - < 1.1.5`

Weaknesses (CWE)

References

https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf

vendor-advisory

patch

https://www.vulncheck.com/advisories/advantech-webaccess-vpn-command-injection-in-appmanagementcontroller

third-party-advisory

https://icr.advantech.com/download/software

product

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.