CVE-2025-34243
📋 TL;DR
Advantech WebAccess/VPN versions prior to 1.1.5 contain a SQL injection vulnerability in the AjaxFwRulesController.ajaxNetworkFwRulesAction() function. Authenticated low-privileged users can exploit this via datatable search parameters to extract database information. This affects organizations using vulnerable Advantech VPN portal software.
💻 Affected Systems
- Advantech WebAccess/VPN
📦 What is this software?
Webaccess\/vpn by Advantech
⚠️ Risk & Real-World Impact
Worst Case
Full database compromise including credentials, configuration data, and sensitive network information leading to lateral movement or complete system takeover.
Likely Case
Disclosure of database contents including user credentials, firewall rules, and network configuration data that could enable further attacks.
If Mitigated
Limited information disclosure if proper input validation and database permissions are enforced.
🎯 Exploit Status
SQL injection via authenticated endpoint makes exploitation straightforward for attackers with valid credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.1.5
Vendor Advisory: https://icr.advantech.com/support/router-models/download/511/sa-2025-01-vpn-portal-2025-11-06.pdf
Restart Required: Yes
Instructions:
1. Download version 1.1.5 from Advantech support portal. 2. Backup current configuration. 3. Apply the update following vendor instructions. 4. Restart the VPN service. 5. Verify the update was successful.
🔧 Temporary Workarounds
Input Validation Filter
allImplement web application firewall or input validation to block SQL injection patterns in datatable search parameters.
WAF specific - configure rules to block SQL injection patterns in POST parameters
Database Permission Restriction
allLimit database user permissions to read-only for application accounts to prevent data modification.
Database specific - ALTER USER 'app_user'@'localhost' WITH READ ONLY;
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries at the application level
- Restrict network access to the VPN portal using firewall rules and implement multi-factor authentication
🔍 How to Verify
Check if Vulnerable:
Check the application version via admin interface or configuration files. If version is below 1.1.5, the system is vulnerable.Check Version:
Check via admin web interface or examine application configuration files for version information.Verify Fix Applied:
After patching, verify version shows 1.1.5 or higher and test the vulnerable endpoint with SQL injection payloads to confirm they are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in application logs
- Multiple failed login attempts followed by successful authentication and SQL-like patterns in search parameters
- Database error messages containing SQL syntax
Network Indicators:
- Unusual database connections from application server
- Large volume of requests to AjaxFwRulesController endpoint with SQL-like parameters
SIEM Query:
source="web_access_logs" AND (url="*ajaxNetworkFwRulesAction*" AND (param="*SELECT*" OR param="*UNION*" OR param="*OR 1=1*"))