What is CVE-2025-22470?

CVE-2025-22470 is a critical-severity vulnerability in Sato Corporation Cl4/6nx-J Plus (Japan Model), classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 9.8/10. Published 2025-08-06.

How severe is CVE-2025-22470?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Arbitrary file upload in Sato Corporation Cl4/6nx-J Plus (Japan Model)

CVE-2025-22470

CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1 allow crafted dangerous files to be uploaded. An arbitrary Lua script may be executed on the system with the root privilege.

Vulnerability class: Unrestricted File Upload

EPSS: 0.007 (50.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Sato Corporation Cl4/6nx-j Plus (Japan Model) — versions prior to firmware 1.15.5-r1
Sato Corporation Cl4/6nx Plus — versions prior to firmware 1.15.5-r1

Weakness classification (CWE)

CWE-434 — Unrestricted Upload of File with Dangerous Type

References

Frequently asked questions

What is CVE-2025-22470?: CVE-2025-22470 is a critical-severity vulnerability in Sato Corporation Cl4/6nx-J Plus (Japan Model), classified under Unrestricted Upload of File with Dangerous Type. CVSS score: 9.8/10. Published 2025-08-06.
How severe is CVE-2025-22470?: Critical severity. CVSS v3 base score is 9.8 out of 10.