Read the docs

Advantech

Records434All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical118CVSS 9.0–10.0
CVSS high195CVSS 7.0–8.9

Exploited now

Advantech records in CISA KEV

No Advantech vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Webaccess 103 records HIGH Advantech Webaccess 44 records HIGH R-seenet 40 records HIGH Iview 37 records HIGH Webaccess/scada 29 records MEDIUM Eki-6333ac-1gpo Firmware 20 records MEDIUM Eki-6333ac-2g Firmware 20 records MEDIUM Eki-6333ac-2gd Firmware 20 records MEDIUM

Records

12 records in Webaccess/vpn · all components

TI-2025-24385 CVE-2025-34239 · GHSA-v7qq-g7hw-pj84

Advantech WebAccess/VPN < 1.1.5 Command Injection in AppManagementController.appUpgradeAction()

Priority MEDIUM 49

Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as t…

CVSS 4.0HIGH 8.6 Network High privileges No interaction EPSS 0.01699 Published 2025-11-06 Fixed in 1.1.5 CWE-78
TI-2025-24386 CVE-2025-34240 · GHSA-h6f4-2rv9-p9w8

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AppManagementController.appUpgradeAction()

Priority MEDIUM 45

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated low-privileged observer user to inject SQL via datatable se…

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00312 Published 2025-11-06 Fixed in 1.1.5 CWE-89
TI-2025-24388 CVE-2025-34242 · GHSA-m2mg-hpv9-cffv

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxNetworkController.ajaxAction()

Priority LOW 39

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxNetworkController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search par…

CVSS 4.0HIGH 8.6 Network Low privileges No interaction EPSS 0.00312 Published 2025-11-06 Fixed in 1.1.5 CWE-89
TI-2025-24384 CVE-2025-34238 · GHSA-mhv6-73gf-63qx

Path traversal in Advantech WebAccess/VPN

Priority LOW 37

Advantech WebAccess/VPN versions prior to 1.1.5 contain an absolute path traversal via AjaxStandaloneVpnClientsController.ajaxDownloadRoadWarriorConfigFileAction() that allows an authenticated network administrator to ca…

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00409 Published 2025-11-06 Fixed in 1.1.5 CWE-22
TI-2025-24392 CVE-2025-34246 · GHSA-jq34-jj88-v48g

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxPrevalidationController.ajaxAction()

Priority LOW 24

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxPrevalidationController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatable sear…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00312 Published 2025-11-06 Fixed in 1.1.5 CWE-89
TI-2025-24391 CVE-2025-34245 · GHSA-7rgm-h6gw-hp5g

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxStandaloneVpnClientsController.ajaxAction()

Priority LOW 24

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxStandaloneVpnClientsController.ajaxAction() that allows an authenticated low-privileged observer user to inject SQL via datatab…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00312 Published 2025-11-06 Fixed in 1.1.5 CWE-89
TI-2025-24390 CVE-2025-34244 · GHSA-ff9r-mxxm-wqxj

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxFwRulesController.ajaxDeviceFwRulesAction()

Priority LOW 24

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxDeviceFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datatab…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00312 Published 2025-11-06 Fixed in 1.1.5 CWE-89
TI-2025-24389 CVE-2025-34243 · GHSA-8xq3-r8f5-3hw3

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxFwRulesController.ajaxNetworkFwRulesAction()

Priority LOW 24

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxFwRulesController.ajaxNetworkFwRulesAction() that allows an authenticated low-privileged observer user to inject SQL via datata…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00312 Published 2025-11-06 Fixed in 1.1.5 CWE-89
TI-2025-24387 CVE-2025-34241 · GHSA-xv26-38rg-x8c2

Advantech WebAccess/VPN < 1.1.5 SQL Injection via AjaxDeviceController.ajaxDeviceAction()

Priority LOW 24

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction() that allows an authenticated low-privileged observer user to inject SQL via datatable searc…

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00312 Published 2025-11-06 Fixed in 1.1.5 CWE-89
TI-2025-24393 CVE-2025-34247 · GHSA-4j92-6j9c-j5g7

Advantech WebAccess/VPN < 1.1.5 SQL Injection via NetworksController.addNetworkAction()

Priority LOW 23

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in NetworksController.addNetworkAction() that allows an authenticated low-privileged observer user to inject SQL via datatable search…

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00316 Published 2025-11-06 Fixed in 1.1.5 CWE-89
Open these records in search →