CVE-2025-14850CWE-22

Advantech WebAccess/SCADA Improper Limitation of a Pathname to a Restricted Directory

High · published December 18, 2025

CVSS v4.0
7.2
EPSS
1%
Percentile
60.6
In the wild
Unconfirmed
What it is

⚡ A sneaky directory traversal flaw is hiding in Advantech WebAccess/SCADA that could let attackers delete any file they choose! 🔥 Think of it like a maintenance worker who can access areas behind the scenes without permission — if they know their way around, they could erase critical documents from the archives without anyone noticing! The potential fallout from this vulnerability is absolutely devastating. An attacker could exploit this flaw to delete essential files, disrupting operations and potentially leading to catastrophic failures in your SCADA system. The implications for data integrity and overall system reliability are significant!

Put simply

Think of it like a maintenance worker who can access areas behind the scenes without permission — if they know their way around, they could erase critical documents from the archives without anyone noticing! This directory traversal vulnerability allows attackers to manipulate file paths, enabling unauthorized deletion of files that should be protected within the Advantech WebAccess/SCADA application.

What to do

The potential fallout from this vulnerability is absolutely devastating. An attacker could exploit this flaw to delete essential files, disrupting operations and potentially leading to catastrophic failures in your SCADA system. The implications for data integrity and overall system reliability are significant! To mitigate this risk, patch your system to the latest version immediately. Additionally, implement strict access controls and conduct a thorough review of directory permissions to ensure sensitive files are safeguarded. You've got this! With these steps, you can restore security and keep your systems running smoothly! 🛡️

The record
Technical detail
CVSS v4.0
7.2 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00939 · 60.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2025-12-18T20:30Z
EPSS history
Timeline
  • 18 DEC 20:30Z
    Advantech WebAccess/SCADA Improper Limitation of a Pathname to a Restricted Directory
    cvelistv5