CVE-2025-34239: Advantech WebAccess/VPN < 1.1.5 Command Injection in AppManagementController.appUpgradeAction()
Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as the web server user (www-data) by supplying a crafted uploaded filename.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Advantech WebAccess/VPNto a version that resolves this vulnerability.Fixed in 1.1.5
Event History
Frequently Asked Questions
What is the severity of CVE-2025-34239?
CVE-2025-34239 has a high severity due to its command injection vulnerability allowing execution of arbitrary commands.
How do I fix CVE-2025-34239?
To fix CVE-2025-34239, upgrade Advantech WebAccess/VPN to version 1.1.5 or later.
Who is affected by CVE-2025-34239?
CVE-2025-34239 affects users of Advantech WebAccess/VPN versions prior to 1.1.5.
What exploitation capabilities does CVE-2025-34239 provide?
CVE-2025-34239 allows an authenticated system administrator to execute arbitrary commands on the web server.
What component of Advantech WebAccess/VPN is vulnerable in CVE-2025-34239?
CVE-2025-34239 specifically affects the AppManagementController appUpgradeAction() component.