CVE-2025-14849

HighCVSS 8.8

Published: 18/12/2025(UTC)Updated: 30/09/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.62%

48th percentile - higher than 48% of all known CVEs

Summary

Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code.

Risk Assessment

The risk is critical because an attacker could gain full control over the SCADA system, potentially leading to disruptions in industrial processes, data integrity compromise, or other severe impacts.

Recommendation

Immediately update Advantech WebAccess/SCADA to the latest version and restrict access to trusted users only. Also, implement validation and restrictions on uploaded file types.

Other vulnerabilities in Advantech WebAccess/SCADA

CVE-2026-36226Medium
A Cross-Site Scripting (XSS) vulnerability was detected in Advantech WebAccess/SCADA 8.0-2015.08.16 in the Create New Project User component, in the decryption field. A remote attacker can obtain sensitive information.

Original NVD description (English source)

Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS