CVE-2025-27454

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-27454
The application is vulnerable to cross-site request forgery. An attacker can trick a valid, logged in user into submitting a web request that they did not intend. The request uses the victim's browser's saved authorization to execute the request.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://sick.com/psirt Vendor Advisory
https://sick.com/psirt Vendor Advisory
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices US Government Resource
https://www.endress.com Product
https://www.first.org/cvss/calculator/3.1 Not Applicable
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json Vendor Advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:o:endress:meac300-fnade4_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:endress:meac300-fnade4:-:*:*:*:*:*:*:*
History

06 Feb 2026, 14:39

Type Values Removed Values Added
References () https://sick.com/psirt - () https://sick.com/psirt - Vendor Advisory
References () https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - () https://www.cisa.gov/resources-tools/resources/ics-recommended-practices - US Government Resource
References () https://www.endress.com - () https://www.endress.com - Product
References () https://www.first.org/cvss/calculator/3.1 - () https://www.first.org/cvss/calculator/3.1 - Not Applicable
References () https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - () https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json - Vendor Advisory
References () https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf - () https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf - Vendor Advisory
First Time Endress
Endress meac300-fnade4 Firmware
Endress meac300-fnade4
Summary
  • (es) La aplicación es vulnerable a cross-site request forgery. Un atacante puede engañar a un usuario con sesión iniciada para que envíe una solicitud web no deseada. La solicitud utiliza la autorización guardada del navegador de la víctima para ejecutarse.
CPE cpe:2.3:o:endress:meac300-fnade4_firmware:*:*:*:*:*:*:*:*
cpe:2.3:h:endress:meac300-fnade4:-:*:*:*:*:*:*:*

03 Jul 2025, 12:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-03 12:15

Updated : 2026-02-06 14:39

NVD link : CVE-2025-27454

Mitre link : CVE-2025-27454

CVE.ORG link : CVE-2025-27454

JSON object : View

Products Affected

endress

  • meac300-fnade4_firmware
  • meac300-fnade4
CWE
CWE-352

Cross-Site Request Forgery (CSRF)