Cyber Resilience

CVE-2025-14850

High

Published: 18 December 2025

Published
18 December 2025
Modified
31 December 2025
KEV Added
—
Patch
—
CVSS Score v4 7.2 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0081 51.9th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-14850 is a high-severity Path Traversal (CWE-22) vulnerability in Advantech Webaccess\/Scada. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-14850 is a directory traversal vulnerability (CWE-22) in Advantech WebAccess/SCADA. Published on 2025-12-18T21:15:52.900, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). The issue enables an attacker to delete arbitrary files on the affected system.

The vulnerability can be exploited remotely over the network by an attacker with low privileges, requiring low attack complexity and no user interaction. Successful exploitation allows deletion of arbitrary files, leading to high integrity and availability impacts but no confidentiality loss.

For mitigation guidance, refer to CISA ICS Advisory ICSA-25-352-06 at https://www.cisa.gov/news-events/ics-advisories/icsa-25-352-06, the corresponding CSAF JSON file at https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsa-25-352-06.json, and Advantech's support details at https://www.advantech.com/en-us/support/details/installation?id=1-MS9MJV.

EU & UK References

Vulnerability details

Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files.

CWE(s)
CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1070.004 File Deletion Stealth
Adversaries may delete files left behind by the actions of their intrusion activity.
attack.mitre.org →
Why these techniques?

Directory traversal in public-facing WebAccess/SCADA enables remote exploitation of public-facing application (T1190). Allows arbitrary file deletion, facilitating indicator removal via file deletion (T1070.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-14849Same product: Advantech Webaccess\/Scada
CVE-2025-62630Same vendor: Advantech
CVE-2025-58423Same vendor: Advantech
CVE-2025-59171Same vendor: Advantech
CVE-2026-4350Shared CWE-22
CVE-2025-4828Shared CWE-22
CVE-2025-69377Shared CWE-22
CVE-2026-34728Shared CWE-22
CVE-2025-14306Shared CWE-22
CVE-2026-1056Shared CWE-22

Affected Assets

advantech
webaccess\/scada
9.2.1

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly remediates the directory traversal flaw in Advantech WebAccess/SCADA by requiring timely identification, reporting, and correction of the vulnerability.

SI-10 Information Input Validation good match
prevent

Validates information inputs at system entry points to reject path traversal sequences that enable arbitrary file deletion.

AC-3 Access Enforcement partial match
prevent

Enforces approved access authorizations to limit low-privilege users from deleting files outside intended directories.

References