CVE-2025-14849 HIGH

CVE-2025-14849: Advantech WebAccess/SCADA Unrestricted Upload of File with Dangerous Type

Vendor Advantech
Product WebAccess/SCADA
Weakness CWE-434 · Unrestricted file upload
Published December 18, 2025
Last update December 18, 2025
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Advantech WebAccess/SCADA  is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code.

Key dates

02Disclosure timeline

December 18, 2025 CVE published
December 18, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2024-49324 WordPress Sovratec Case Management plugin <= 1.0.0 - Arbitrary File Upload vulnerability CVE-2026-2701 RCE vulnerability in Progress ShareFile Storage Zones Controller (SZC) CVE-2025-31979 A File Upload Validation Bypass vulnerability has been identified in the HCL BigFix Service Management (SM) CVE-2024-52376 WordPress Boat Rental Plugin for WordPress plugin <= 1.0.1 - Arbitrary File Upload vulnerability CVE-2024-32836 WordPress WP-Lister Lite for eBay plugin <= 3.5.11 - Arbitrary File Upload vulnerability