The vulnerability of the AjaxDeviceController.ajaxDeviceAction() function in the software for remote monitoring with virtual private network capabilities, Advantech WebAccess/VPN, allows a perpetrator to gain access to database-related information.

The vulnerability of the AjaxDeviceController.ajaxDeviceAction function in the software for remote monitoring with Advantech WebAccess/VPN virtual private network capabilities is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability could allow a...

CVE-2025-34241: Improper Neutralization of Special Elements used in an SQL Command

Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in AjaxDeviceController.ajaxDeviceAction that allows an authenticated low-privileged observer user to inject SQL via datatable search parameters, leading to disclosure of database information...