CVE-2025-14849 is a high severity unrestricted file upload (CVSS 8.8) in Advantech WebAccess/SCADA 9.2.1. CISA's advisory says it may allow remote code execution, and Advantech recommends updating to version 9.2.2. Apply that update, then review which accounts can reach the web interface and keep the product off the internet.
What's affected
CISA advisory ICSA-25-352-06, released 18 December 2025, lists Advantech WebAccess/SCADA 9.2.1 as known affected for this CVE. The advisory is a shared one: it covers five CVEs in the same product, including CVE-2025-14850, CVE-2025-14848, CVE-2025-46268 and CVE-2025-67653.
- Severity: High, CVSS 8.8, vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hper the CISA entry. - Network reachable and low complexity, with low privileges required. In other words, an authenticated user, not an anonymous visitor.
- Fixed version: 9.2.2, per Advantech's recommendation in the advisory.
- Exploitation in the wild: not in the CISA KEV catalog, and the advisory does not say it is being exploited.
CISA lists the affected sectors as Critical Manufacturing, Energy, and Water and Wastewater, deployed worldwide, with the vendor headquartered in Taiwan.
How to check if you're exposed
Check the installed version of WebAccess/SCADA on every server that runs it. The product's own about or version page shows it, and so does the Windows list of installed programs.
# On the server, list the installed product and version
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object DisplayName -like "*WebAccess*" |
Select-Object DisplayName, DisplayVersion
If the version is 9.2.1, you match the advisory. The advisory does not describe older builds, so check the vendor page for those. Then work out who has accounts: the vector needs low privileges, so a stolen or shared login is enough to matter.
The vendor's download and support page is linked from the record and is the place to confirm the fixed build.
What to do now
- Find every WebAccess/SCADA installation, including engineering workstations and test systems.
- Back up the configuration and project files.
- Apply version 9.2.2 as Advantech recommends, following the vendor's upgrade notes.
- Review the accounts that can sign in to the web interface. Remove unused ones and change shared passwords.
- Keep the product off the internet. CISA's general guidance for control systems is to place them behind firewalls and isolate them from business networks.
- Review the server for unexpected files in upload locations and unexpected processes.
- Record the change in your asset register.
Why it matters
The class is CWE-434: the software lets a user upload a file of a dangerous type, and that file can later be run or served. When an uploaded file ends up where the server executes it, a file transfer turns into code execution. That is why the advisory's summary says the flaw may allow remote code execution.
The platform matters as much as the bug. SCADA software supervises physical processes such as power, water and manufacturing lines. A compromise there is not only a data problem. The authentication requirement helps, but credentials in operational environments are often shared and rarely rotated.
Fix, restrict and monitor. The fix is a vendor release, so this one is a plain upgrade job once you have tested it.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2025-14849?
According to CISA advisory ICSA-25-352-06, Advantech recommends updating WebAccess/SCADA to version 9.2.2. Confirm on Advantech's own page before you deploy.
Does an attacker need to log in?
The CVSS vector in the CISA entry says low privileges are required, so an authenticated account is needed. That still covers any shared, weak or stolen credential.
Sources
- CVE-2025-14849 record on NVD
- CVE-2025-14849 on Gold
- CISA advisory ICSA-25-352-06
- CISA CSAF file for ICSA-25-352-06
Last reviewed: 19 October 2026.
