Cyber Posture

CVE-2025-14850

High

Published: 18 December 2025

Published
18 December 2025
Modified
31 December 2025
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS Score 0.0061 70.0th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the directory traversal flaw in Advantech WebAccess/SCADA by requiring timely identification, reporting, and correction of the vulnerability.

SI-10 Information Input Validation good match
prevent

Validates information inputs at system entry points to reject path traversal sequences that enable arbitrary file deletion.

AC-3 Access Enforcement partial match
prevent

Enforces approved access authorizations to limit low-privilege users from deleting files outside intended directories.

Security SummaryAI

CVE-2025-14850 is a directory traversal vulnerability (CWE-22) in Advantech WebAccess/SCADA. Published on 2025-12-18T21:15:52.900, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). The issue enables an attacker to delete arbitrary files on the affected system.

The vulnerability can be exploited remotely over the network by an attacker with low privileges, requiring low attack complexity and no user interaction. Successful exploitation allows deletion of arbitrary files, leading to high integrity and availability impacts but no confidentiality loss.

For mitigation guidance, refer to CISA ICS Advisory ICSA-25-352-06 at https://www.cisa.gov/news-events/ics-advisories/icsa-25-352-06, the corresponding CSAF JSON file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-352-06.json, and Advantech's support details at https://www.advantech.com/en-us/support/details/installation?id=1-MS9MJV.

Details

CWE(s)
CWE-22

Affected Products

advantech
webaccess\/scada
9.2.1

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1070.004 File Deletion Stealth
Adversaries may delete files left behind by the actions of their intrusion activity.
attack.mitre.org →
Why these techniques?

Directory traversal in public-facing WebAccess/SCADA enables remote exploitation of public-facing application (T1190). Allows arbitrary file deletion, facilitating indicator removal via file deletion (T1070.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References