Advantech WebAccess/VPN Database Information Disclosure

The vulnerability of the AjaxDeviceController.ajaxDeviceAction function in the software for remote monitoring with Advantech WebAccess/VPN virtual private network capabilities is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability could allow a...

CVE-2025-34241: Improper Neutralization of Special Elements used in an SQL Command

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...