CVE-2025-14848
published 2025-12-18CVE-2025-14848: Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files.
PriorityP335medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.56%
42.2th percentile
Advantech WebAccess/SCADA
is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| advantech | webaccess_scada | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvdv4.05.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA ICS
Advantech WebAccess/SCADA
cisa_ics·2025-12-18·CVSS 4.3
CVE-2025-14850 [MEDIUM] Advantech WebAccess/SCADA
ICS Advisory
##
Advantech WebAccess/SCADA
Release DateDecember 18, 2025
Alert CodeICSA-25-352-06
Related topics:
Industrial Control System Vulnerabilities, Industrial Control Systems
View CSAF
## Summary
Successful exploitation of these vulnerabilities could allow an authenticated attacker to read or modify a remote database.
The following versions of Advantech WebAccess/SCADA are affected:
- WebAccess/SCADA (CVE-2025-14850, CVE-2025-14849, CVE-2025-14848, CVE-2025-46268, CVE-2025-67653)
CVSS
Vendor
Equipment
Vulnerabilities
| v3 8.8
| Advantech
| Advantech WebAccess/SCADA
| Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Unrestricted Upload of File with Dangerous Type, Absolute Path Traversal, Improper Neutralization of Sp
GHSA
GHSA-pv73-6jm3-25wx: Advantech WebAccess/SCADA
is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files
ghsa_unreviewed·2025-12-18
CVE-2025-14848 [MEDIUM] CWE-36 GHSA-pv73-6jm3-25wx: Advantech WebAccess/SCADA
is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files
Advantech WebAccess/SCADA
is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-12-18
Published