Security Advisory

CVE-2025-14849: Advantech WebAccess/SCADA Unrestricted File Upload RCE

Last updated:
  • CVE-2025-14849

CVE-2025-14849 is an unrestricted file upload vulnerability in Advantech WebAccess/SCADA version 9.2.1 that lets an attacker remotely execute arbitrary code on the SCADA host; it is one of five vulnerabilities CISA disclosed together in the same advisory, and Advantech's fix is to update to version 9.2.2.

Vulnerability summary

9.8

Critical

0.6%

EPSS score (FIRST)

No

CISA KEV catalog

2025-12-18

Published

Vulnerability ID: CVE-2025-14849 · Source: NVD

Affected components

ComponentCPEVersion range
Advantech WebAccess/SCADAcpe:2.3:a:advantech:webaccess\/scada:9.2.1:*:*:*:*:*:*:*9.2.1 (fixed in 9.2.2)

What this means

CVE-2025-14849 is an unrestricted upload of file with dangerous type vulnerability (CWE-434) in Advantech WebAccess/SCADA. NVD's description states plainly: "Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code" (NVD).

NVD's own analysis assigns a Primary CVSS v3.1 score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — network-reachable, low attack complexity, no privileges or user interaction required. CISA's ICS-CERT ADP submission separately scores the same issue lower, at CVSS v3.1 8.8 (vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, requiring low privileges) and CVSS v4.0 8.7; this page reports the NVD Primary figure of 9.8 (NVD).

CISA's ICS advisory ICSA-25-352-06, affecting the Critical Manufacturing sector and published 2025-12-18, discloses CVE-2025-14849 together with four related flaws in the same WebAccess/SCADA build (version 9.2.1): CVE-2025-14850 (path traversal, CWE-22, CVSS v3.1 8.1), CVE-2025-46268 (SQL injection, CWE-89, CVSS v3.1 6.3), CVE-2025-14848 and CVE-2025-67653 (both CWE-22/CWE-36 information-disclosure issues, CVSS v3.1 4.3). Advantech's recommended mitigation for all five is to update to WebAccess/SCADA version 9.2.2 (CISA ICS Advisory ICSA-25-352-06).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-30 — confirmed by matching the exact cveID string against the raw KEV feed rather than a summarized check. FIRST scores the probability of exploitation at 0.00618 (49.602nd percentile) as of 2026-10-30 (CISA KEV, FIRST EPSS).

WebAccess/SCADA operators on version 9.2.1 should update to 9.2.2, which addresses this and the four related CVEs disclosed in the same advisory, and should keep the SCADA management interface off any network reachable from the general internet, consistent with CISA's standing ICS network-segmentation guidance.

How to fix this class of issueThis advisory's weakness class is Path traversal. Our practical guide covers how to detect, fix, verify and disclose it: How to fix path traversal in embedded firmware.

Evidence

  • Advantech WebAccess/SCADA 9.2.1 is vulnerable to unrestricted file upload, allowing an attacker to remotely execute arbitrary code. — NVD
  • NVD Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; CISA's ADP score for the same CVE is lower, 8.8 (PR:L required). — NVD
  • Disclosed alongside four related CVEs (CVE-2025-14850, CVE-2025-46268, CVE-2025-14848, CVE-2025-67653) affecting the same WebAccess/SCADA 9.2.1 build; fixed in version 9.2.2. — CISA ICS Advisory ICSA-25-352-06
  • Not present in the CISA KEV catalog as of 2026-10-30, confirmed against the raw feed's exact cveID strings. — CISA KEV
  • EPSS score is 0.00618 (49.602nd percentile) as of 2026-10-30. — FIRST EPSS

Check if your firmware is affected

Get a firmware scan reportTrack this CVEChat with David on WhatsApp

Related advisories

CVE-2025-2749: Kentico Xperience Staging Sync Server RCE (KEV)CISA KEVCVE-2025-2749: KEV path traversal and arbitrary file upload in Kentico Xperience's Staging Sync Server, chainable to remote code execution. Versions, scoring, sourced to NVD, VulnCheck and CISA KEV.CVE-2025-34028: Commvault Command Center Path Traversal to Unauthenticated RCE (KEV)CISA KEVCVE-2025-34028: KEV path-traversal flaw in Commvault Command Center lets unauthenticated attackers upload malicious ZIPs and execute arbitrary code. Versions, patches, scoring, sourced to NVD, CISA and Commvault.CVE-2025-61624: Fortinet FortiOS/FortiProxy/FortiPAM CLI Path Traversal (KEV)CISA KEVCVE-2025-61624: KEV path traversal in the Fortinet CLI lets an authenticated admin write or delete arbitrary files on FortiOS, FortiProxy, FortiPAM and FortiSwitchManager; actively exploited. NVD/CISA scoring.

Sources

  1. NVD
  2. CISA ICS Advisory ICSA-25-352-06
  3. CISA KEV
  4. FIRST EPSS