CVE-2025-34239

High · 7.2

CVSS

7.2

EPSS

1.7%

Published

Nov 6, 2025

CISA due date

—

The record

Advantech WebAccess/VPN versions prior to 1.1.5 contain a command injection vulnerability in AppManagementController.appUpgradeAction() that allows an authenticated system administrator to execute arbitrary commands as the web server user (www-data) by supplying a crafted uploaded filename.

Affected packages

Ecosystem	Package	Introduced	Fixed