CVE-2025-22470: CL4/6NX Plus RCE Vulnerability

CVE-2025-22470 Overview

CVE-2025-22470 is a critical unrestricted file upload vulnerability affecting SATO CL4/6NX Plus and CL4/6NX-J Plus (Japan model) industrial label printers running firmware versions prior to 1.15.5-r1. The vulnerability allows attackers to upload crafted dangerous files to the device, enabling the execution of arbitrary Lua scripts with root privileges on the affected system.

This firmware vulnerability represents a significant security risk in industrial printing environments, as successful exploitation grants attackers complete control over the device with the highest level of system privileges.

Critical Impact

Remote attackers can upload malicious Lua scripts and execute arbitrary code with root privileges, potentially compromising the entire device and enabling lateral movement within industrial networks.

Affected Products

• SATO CL4NX Plus with firmware versions prior to 1.15.5-r1
• SATO CL6NX Plus with firmware versions prior to 1.15.5-r1
• SATO CL4NX-J Plus (Japan model) with firmware versions prior to 1.15.5-r1
• SATO CL6NX-J Plus (Japan model) with firmware versions prior to 1.15.5-r1

Discovery Timeline

• 2025-08-06 - CVE-2025-22470 published to NVD
• 2025-08-06 - Last updated in NVD database

Technical Details for CVE-2025-22470

Vulnerability Analysis

This vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The affected SATO industrial label printers fail to properly validate or restrict the types of files that can be uploaded to the device. This lack of input validation on file uploads creates a direct path for attackers to introduce malicious content onto the system.

The most concerning aspect of this vulnerability is the execution context—uploaded Lua scripts execute with root privileges, granting attackers unrestricted access to the underlying operating system. Industrial devices like label printers are often overlooked in security audits, making them attractive targets for establishing persistent access within operational technology (OT) environments.

Root Cause

The root cause of CVE-2025-22470 lies in insufficient file upload validation within the printer's firmware. The device fails to implement proper checks on uploaded file types, content validation, or execution restrictions. Without these safeguards, the system accepts and processes dangerous file types, including executable Lua scripts, without proper sanitization or containment.

The firmware's design apparently allows uploaded Lua scripts to run in a privileged context, likely due to the device architecture requiring elevated permissions for certain scripting functionality. This architectural decision, combined with the missing upload restrictions, creates the conditions necessary for arbitrary code execution.

Attack Vector

The vulnerability is exploitable over the network without authentication requirements. An attacker can craft a malicious Lua script designed to perform actions such as establishing reverse shells, modifying device configurations, exfiltrating data, or pivoting to other network-connected systems.

The attack sequence involves identifying vulnerable SATO CL4/6NX Plus devices on the network, crafting a malicious Lua script payload, uploading the dangerous file through the device's file upload mechanism, and achieving code execution with root privileges when the script is processed or triggered.

Since these devices are commonly deployed in manufacturing, logistics, and retail environments for industrial labeling operations, compromise could disrupt critical business operations or serve as an entry point for broader network intrusion.

Detection Methods for CVE-2025-22470

Indicators of Compromise

• Unexpected Lua script files appearing on SATO label printer devices
• Anomalous network connections originating from printer devices to external IP addresses
• Unusual file upload activity to printer management interfaces
• Unexpected process execution or system resource utilization on affected devices

Detection Strategies

• Monitor network traffic to and from SATO label printers for unusual patterns or connections to unknown external hosts
• Implement file integrity monitoring on printer firmware and configuration directories to detect unauthorized file additions
• Deploy network segmentation rules that alert on unexpected outbound connections from OT devices
• Review web server and application logs on affected devices for suspicious file upload requests

Monitoring Recommendations

• Establish baseline network behavior for industrial printers and alert on deviations
• Implement IDS/IPS rules to detect common Lua-based exploitation patterns in network traffic
• Configure SIEM alerts for any administrative access or file operations on label printer devices
• Regularly audit firmware versions across all SATO devices to identify unpatched systems

How to Mitigate CVE-2025-22470

Immediate Actions Required

• Upgrade all SATO CL4/6NX Plus and CL4/6NX-J Plus devices to firmware version 1.15.5-r1 or later immediately
• Isolate affected printers on segmented network zones until patching is complete
• Restrict network access to printer management interfaces to authorized administrative hosts only
• Review device logs for evidence of exploitation attempts prior to patching

Patch Information

SATO has released firmware version 1.15.5-r1 to address this vulnerability. Organizations should obtain the updated firmware from SATO's official support channels and apply the update following the manufacturer's upgrade procedures. Refer to the SATO Global Support Notice for official patch information and the JVN Security Advisory for additional technical details.

Workarounds

• Place affected devices behind firewall rules that block inbound connections from untrusted networks
• Disable or restrict access to file upload functionality if not required for business operations
• Implement network access control lists (ACLs) limiting which hosts can communicate with printer management interfaces
• Deploy network monitoring to detect and alert on any exploitation attempts against vulnerable devices

# Example network ACL to restrict printer management access
# Restrict access to SATO printer management interface to admin subnet only
iptables -A INPUT -s 10.10.10.0/24 -d <PRINTER_IP> -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -s 10.10.10.0/24 -d <PRINTER_IP> -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -d <PRINTER_IP> -p tcp --dport 80 -j DROP
iptables -A INPUT -d <PRINTER_IP> -p tcp --dport 443 -j DROP