Advantech WebAccess/VPN Command Injection Vulnerability in AppManagementController

A command injection vulnerability has been identified in Advantech WebAccess/VPN versions prior to 1.1.5. The issue resides in the AppManagementController.appUpgradeAction() method, where an authenticated system administrator can execute arbitrary commands as the web server user (www-data) by providing a specially crafted uploaded filename.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the server, executed as the web server user (www-data).

Remediation

Users are advised to upgrade to Advantech WebAccess/VPN version 1.1.5.