July 29, 2026

CVE Watchtower


← Back to CVE List

CVE-2025-22470NVD

Vulnerability Summary

CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1 allow crafted dangerous files to be uploaded. An arbitrary Lua script may be executed on the system with the root privilege.
Severity Level
CRITICAL(9.3)
Published Date
Aug 6, 2025
Last Modified
Aug 6, 2025
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
Data Pending
Root Weakness (CWE)
CWE-434: Unrestricted File Upload ↗
The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.
CVSS v4.0 Base Metrics
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionNone

External References