CVE-2025-14850 is a high severity directory traversal (CVSS 8.1) in Advantech WebAccess/SCADA 9.2.1 that may allow an attacker to delete arbitrary files. Advantech recommends version 9.2.2. Apply that update, confirm you have a restorable backup, restrict who can sign in, and keep the product off the internet.
What's affected
CISA advisory ICSA-25-352-06, released 18 December 2025, lists WebAccess/SCADA 9.2.1 as known affected. The advisory bundles five CVEs for the product: CVE-2025-14850, CVE-2025-14849, CVE-2025-14848, CVE-2025-46268 and CVE-2025-67653. Plan one upgrade that closes them all.
- Severity: High, CVSS 8.1, vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. - Network reachable, low complexity, low privileges required.
- Impact: no loss of confidentiality is scored, but high integrity and high availability impact. Deleting files fits that picture.
- Fixed version: 9.2.2, per the vendor recommendation in the advisory.
- Exploitation in the wild: not in CISA KEV, and the advisory does not say it is exploited.
The record's weakness class is CWE-22.
How to check if you're exposed
Read the installed version on each WebAccess/SCADA server. If it is 9.2.1, it matches the advisory.
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object DisplayName -like "*WebAccess*" |
Select-Object DisplayName, DisplayVersion
Next, list the accounts that can sign in to the web interface. The scoring requires low privileges, so the number of valid logins sets your exposure. Note which of them are shared or have not changed passwords in a long time.
If you hold backups of project and configuration files, confirm that you can restore them. A file deletion bug is a problem you recover from, and recovery depends on backups you have tested.
What to do now
- Inventory all WebAccess/SCADA installs.
- Verify that you have a recent, restorable backup of configuration and project data.
- Upgrade to 9.2.2 as Advantech recommends, using the vendor's notes.
- Remove unused accounts and replace shared passwords.
- Isolate the system from the internet and from business networks, using firewalls.
- After the upgrade, check that the service starts and that your projects load.
- Log the change for audit.
Why it matters
Path traversal, CWE-22, happens when software builds a file path from input and does not keep it inside the intended directory. In this case the advisory describes the outcome as the ability to delete arbitrary files. Deleting a configuration or a service file can stop a supervisory system, which is why availability is scored high.
The setting makes it more serious than the number suggests. The advisory lists critical manufacturing, energy, and water and wastewater among the sectors. Losing a supervisory system for a day has costs that a score cannot express. The authentication requirement helps, but treat it as a speed bump, not a barrier.
Quick check
Is CVE-2025-14850 the only issue fixed in 9.2.2?
No. CISA's advisory ICSA-25-352-06 covers five CVEs in the product, all with the same recommendation to update to 9.2.2. Read the advisory for the full list.
Can this expose data?
The CVSS vector scores no confidentiality impact, only integrity and availability. The advisory's wording is about deleting files.
Sources
- CVE-2025-14850 record on NVD
- CVE-2025-14850 on Gold
- CISA advisory ICSA-25-352-06
- CISA CSAF file for ICSA-25-352-06
Last reviewed: 19 October 2026.
