PT-2025-32149 · Unknown · Cl4/6Nx-J Plus+1

Masahiro Iida · Published 2025-08-04 · Updated 2025-08-07 · CVE-2025-22470

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CL4/6NX Plus versions prior to 1.15.5-r1 CL4/6NX-J Plus (Japan model) versions prior to 1.15.5-r1

Description The CL4/6NX Plus and CL4/6NX-J Plus devices are susceptible to arbitrary Lua script execution. This occurs due to the ability to upload crafted dangerous files. Successful exploitation allows execution of Lua scripts with root privileges on the system.

Recommendations Update CL4/6NX Plus to firmware version 1.15.5-r1 or later. Update CL4/6NX-J Plus (Japan model) to firmware version 1.15.5-r1 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2025-09584

CVE-2025-22470

Affected Products

Cl4/6Nx Plus

Cl4/6Nx-J Plus

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-22470 · Security Note
• https://bdu.fstec.ru/vul/2025-09584 · Security Note
• https://twitter.com/CVEnew/status/1953038134452551833 · Twitter Post
• https://twitter.com/fridaysecurity/status/1953256303448498495 · Twitter Post
• https://t.me/pentestingnews/65886 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1953050352481194149 · Twitter Post
• https://t.me/CVEtracker/29326 · Telegram Post
• https://sato-global.com/support_notices/240830 · Note
• https://jvn.jp/en/jp/JVN16547726 · Note
• https://t.me/cveNotify/131051 · Telegram Post