PatchSiren cyber security CVE debrief

CVE-2025-14849 Advantech CVE debrief

Advantech WebAccess/SCADA contains an unrestricted file upload vulnerability that may allow an attacker to remotely execute arbitrary code. The vulnerability was disclosed by CISA on December 18, 2025, with a CVSS 3.1 score of 8.8 (HIGH). The attack vector is network-based with low attack complexity, requiring low privileges but no user interaction. Successful exploitation could result in high impacts to confidentiality, integrity, and availability. Advantech has released version 9.2.2 to address this vulnerability.

Vendor: Advantech
Product: WebAccess/SCADA
CVSS: HIGH 8.7
CISA KEV: Not listed in stored evidence
Original CVE published: 2025-12-18
Original CVE updated: 2026-09-30
Advisory published: 2025-12-18
Advisory updated: 2026-09-30

Who should care

Organizations operating Advantech WebAccess/SCADA in industrial control system environments, particularly those with internet-exposed or inadequately segmented SCADA interfaces. Critical infrastructure operators in manufacturing, energy, water, and building automation sectors should prioritize patching.

Technical summary

CVE-2025-14849 is an unrestricted file upload vulnerability in Advantech WebAccess/SCADA. The flaw allows authenticated attackers with low privileges to upload arbitrary files, potentially leading to remote code execution. The vulnerability is rated CVSS 3.1 8.8 (HIGH) with network attack vector, low complexity, and high impact across confidentiality, integrity, and availability. Advantech has released version 9.2.2 as a vendor fix.

Defensive priority

HIGH

Recommended defensive actions

Update Advantech WebAccess/SCADA to version 9.2.2 or later per vendor guidance.
Restrict network access to WebAccess/SCADA management interfaces to authorized administrative hosts only.
Implement network segmentation to isolate SCADA systems from untrusted networks.
Monitor for anomalous file upload activities and unexpected executable content in web-accessible directories.
Apply defense-in-depth strategies for industrial control systems as recommended by CISA.

Evidence notes

CISA ICS Advisory ICSA-25-352-06 published December 18, 2025. CVSS 3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Vendor fix available in WebAccess/SCADA 9.2.2.

Sources and references

Verified primary and authoritative sources

CVE-2025-14849 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2025-14849

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2025-14849 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2025-14849

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source item URL
Unverified legacy reference

URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-352-06.json

cisa_csaf
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-352-06

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/topics/industrial-control-systems

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/sites/default/files/publications/emailscams0905.pdf

Reference
Source reference
Unverified legacy reference

URL: https://www.cisa.gov/uscert/ncas/tips/ST04-014

Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.