What’s Vulnerable › Vulnerabilities

CVE-2025-22470

• Severity: critical (CVSS 9.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-06 · updated 2026-06-17
• Weakness: CWE-434

Description

CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1 allow crafted dangerous files to be uploaded. An arbitrary Lua script may be executed on the system with the root privilege.

Affected products

• SATO Corporation CL4/6NX-J Plus (Japan model): before firmware 1.15.5-r1
• SATO Corporation CL4/6NX Plus: before firmware 1.15.5-r1

References

• https://jvn.jp/en/jp/JVN16547726/
• https://www.sato-global.com/support_notices/240830/

Get alerted when CVE-2025-22470 or the next vulnerability affects your stack