Sign-up

ID

VAR-202511-1363


CVE

CVE-2025-34243


TITLE

Advantech WebAccess/VPN AjaxFwRulesController.ajaxNetworkFwRulesAction function SQL injection vulnerability

Trust: 0.6

sources: CNVD: CNVD-2025-31068

DESCRIPTION

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information. Advantech WebAccess/VPN is a virtual private network function integrated into Advantech's WebAccess/SCADA software, designed to provide a secure and reliable network connectivity solution for industrial automation and remote monitoring systems. Advantech WebAccess/VPN contains an SQL injection vulnerability. This vulnerability stems from improper handling of datatable search parameters in the AjaxFwRulesController.ajaxNetworkFwRulesAction function. Attackers can exploit this vulnerability to execute illegal SQL commands and steal sensitive database data

Trust: 1.44

sources: NVD: CVE-2025-34243 // CNVD: CNVD-2025-31068

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-31068

AFFECTED PRODUCTS

vendor:advantechmodel:webaccess\/vpnscope:ltversion:1.1.5

Trust: 1.0

vendor:advantechmodel:webaccess/vpnscope:ltversion:1.1.5

Trust: 0.6

sources: CNVD: CNVD-2025-31068 // NVD: CVE-2025-34243

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2025-34243
value: MEDIUM

Trust: 1.0

disclosure@vulncheck.com: CVE-2025-34243
value: MEDIUM

Trust: 1.0

CNVD: CNVD-2025-31068
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2025-31068
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:L/AU:S/C:C/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2025-34243
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 3.6
version: 3.1

Trust: 1.0

sources: CNVD: CNVD-2025-31068 // NVD: CVE-2025-34243 // NVD: CVE-2025-34243

PROBLEMTYPE DATA

problemtype:CWE-89

Trust: 1.0

sources: NVD: CVE-2025-34243

PATCH

title:Patch for Advantech WebAccess/VPN AjaxFwRulesController.ajaxNetworkFwRulesAction function SQL injection vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/782966

Trust: 0.6

sources: CNVD: CNVD-2025-31068

EXTERNAL IDS

db:NVDid:CVE-2025-34243

Trust: 1.6

db:CNVDid:CNVD-2025-31068

Trust: 0.6

sources: CNVD: CNVD-2025-31068 // NVD: CVE-2025-34243

REFERENCES

url:https://www.vulncheck.com/advisories/advantech-webaccess-vpn-sqli-via-ajaxfwrulescontroller-ajaxnetworkfwrulesaction

Trust: 1.0

url:https://icr.advantech.com/download/software

Trust: 1.0

url:https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2025-34243

Trust: 0.6

sources: CNVD: CNVD-2025-31068 // NVD: CVE-2025-34243

SOURCES

db:CNVDid:CNVD-2025-31068
db:NVDid:CVE-2025-34243

LAST UPDATE DATE

2025-12-20T23:37:30.171000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-31068date:2025-12-19T00:00:00
db:NVDid:CVE-2025-34243date:2025-11-28T16:58:17.007

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-31068date:2025-12-18T00:00:00
db:NVDid:CVE-2025-34243date:2025-11-06T20:15:48.410