Advantech WebAccess/SCADA CVE-2025-14849

Exploitation requires an attacker to have network access to the Advantech WebAccess/SCADA 9.2.1 application AND a valid low-privilege authenticated session (PR:L) - it is NOT a fully unauthenticated flaw. The concrete prerequisite is access to a file-upload function that does not restrict file type or storage location, allowing a malicious file to be placed where the server will execute it (CWE-434). No user interaction is needed (UI:N). Limiting factors: the required authentication and the fact that WebAccess/SCADA servers in properly segmented OT networks are generally not exposed to the internet, narrowing the realistic attacker set to those who have already gained a foothold or valid credentials.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H/VA:H yielding 8.7 is internally consistent with a CWE-434 unrestricted file upload leading to remote code execution: network-reachable, low complexity, requiring only low-privilege authentication and no user interaction, with total impact on the vulnerable system (SC:N/SI:N/SA:N indicate no scope change to other systems). This is a genuinely high-severity issue in the SCADA/HMI context because file-upload-to-RCE on an operations server can pivot to control of industrial processes. However, several exploitation-likelihood signals are absent from the input: no EPSS probability, no CISA KEV listing, no SSVC decision data, and no public exploit code are provided, so this resolves to 'no public exploit identified at time of analysis.' The one limiting factor that tempers raw risk is PR:L - the attacker must already hold a valid (even low-privilege) authenticated session on the WebAccess/SCADA application, which is not typically internet-exposed in well-segmented OT networks. Net assessment: a real and serious vulnerability warranting prompt patching in OT environments, but current data shows no evidence of active or public exploitation, so prioritization should account for the authentication prerequisite and the product's limited real-world footprint rather than assuming imminent mass exploitation.

An attacker with a low-privilege authenticated account (or reused/stolen credentials) on Advantech WebAccess/SCADA 9.2.1 uploads a malicious file - such as a web shell or executable payload - through an upload function that fails to restrict file type or destination. The uploaded file is then executed by the server, granting the attacker arbitrary code execution on the SCADA host. No public proof-of-concept is identified in the provided data; exploitation requires network reachability to the application and valid low-level credentials.