CVE-2025-34243 Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxFwRulesController.ajaxNetworkFwRulesAction()

What is CVE-2025-34243?

CVE-2025-34243 is a medium-severity SQL injection vulnerability in Advantech WebAccess/VPN, published on 6 Nov 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information.

Weakness: CWE-89

Which versions are affected by CVE-2025-34243?

It affects 1 product.

Products include Advantech Webaccess\/Vpn.

How do I fix CVE-2025-34243?

No fix has been published for CVE-2025-34243 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2025-34243 being exploited?

There is no known exploitation of CVE-2025-34243 in the wild and no public exploit code.

Other vulnerabilities in Advantech WebAccess/VPN

• CVE-2025-34239 Advantech WebAccess/VPN < 1.1.5 Command Injection in AppManagementController.appUpgradeAction() High 8.6
• CVE-2025-34240 Advantech WebAccess/VPN < 1.1.5 SQL Injection via AppManagementController.appUpgradeAction() High 8.6
• CVE-2025-34242 Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxNetworkController.ajaxAction() High 8.6
• CVE-2025-34238 Path traversal in WebAccess/VPN Medium 6.9
• CVE-2025-34237 Advantech WebAccess/VPN < 1.1.5 Stored XSS via StandaloneVpnClientsController.addStandaloneVpnClientAction() Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8xq3-r8f5-3hw3.