CVE-2025-22470

🗓️ 06 Aug 2025 09:52:16Reported by jpcertType

CVE-2025-22470 allows unauthorized Lua script execution on CL4/6NX Plus firmware before 1.15.5-r1.

Reporter	Title	Published	Views	Family All 12
BDU FSTEC	The vulnerability of the microprogramming software of industrial thermal printers SATO CL4NX Plus, CL6NX Plus, CL4NX-J Plus, and CL6NX-J Plus lies in the ability to load files of a harmful type without restrictions. This allows attackers to escalate their privileges and execute arbitrary code.	11 Aug 202500:00	–	bdu_fstec
Circl	CVE-2025-22470	6 Aug 202513:39	–	circl
CNNVD	SATO CL4/6NX Plus和SATO CL4/6NX-J Plus 代码问题漏洞	6 Aug 202500:00	–	cnnvd
CVE	CVE-2025-22470	6 Aug 202509:52	–	cve
EUVD	EUVD-2025-23818	3 Oct 202520:07	–	euvd
Japan Vulnerability Notes	JVN#16547726: Multiple vulnerabilities in Sato label printers CL4/6NX Plus and CL4/6NX-J Plus series	6 Aug 202500:00	–	jvn
Japan Vulnerability Notes	Multiple vulnerabilities in Sato label printers CL4/6NX Plus and CL4/6NX-J Plus series	6 Aug 202507:38	–	jvn
NVD	CVE-2025-22470	6 Aug 202510:15	–	nvd
Positive Technologies	PT-2025-32149 · Unknown · Cl4/6Nx-J Plus +1	4 Aug 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-22470	8 Aug 202510:23	–	redhatcve

[
  {
    "vendor": "SATO Corporation",
    "product": "CL4/6NX Plus",
    "versions": [
      {
        "version": "prior to firmware 1.15.5-r1",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "SATO Corporation",
    "product": "CL4/6NX-J Plus (Japan model)",
    "versions": [
      {
        "version": "prior to firmware 1.15.5-r1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
jvn	www.jvn.jp/en/jp/JVN16547726/
sato-global	www.sato-global.com/support_notices/240830/

06 Aug 2025 09:52Current

CVSS 49.3

CVSS 39.8

EPSS0.0068

CWE-434

cve-2025-22470 cl4/6nx plus lua script execution security vulnerability