CVE-2025-27453mediumCWE-1004

CVE-2025-27453: medium-severity vulnerability in Endress+Hauser MEAC300-FNADE4

CVE-2025-27453

Published

Follow this CVE+ Monitor Endress+Hauser MEAC300-FNADE4

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.4%
In short

A website's session cookie is not protected from JavaScript access, allowing scripts to steal your login information. This means malicious code on the page could capture your session and impersonate you.

Technical detail

The PHPSESSION cookie lacks the HttpOnly flag, enabling client-side script access via DOM APIs. An attacker can exploit this through XSS vulnerabilities or malicious JavaScript to exfiltrate session tokens and hijack authenticated user sessions.

Summary generated and translated by AI from the official description.
The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such as JavaScript.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected products
Endress+Hauser · Endress+Hauser MEAC300-FNADE4
Related CVEs — Endress+Hauser MEAC300-FNADE4

In the same product, most dangerous first.

CVE-2025-27456HIGHCVE-2025-27456EPSS 0.6%CVE-2025-27449HIGHCVE-2025-27449EPSS 0.6%CVE-2025-1710HIGHCVE-2025-1710EPSS 0.6%CVE-2025-1708HIGHCVE-2025-1708EPSS 0.5%CVE-2025-27452MEDIUMCVE-2025-27452EPSS 0.5%CVE-2025-27451MEDIUMCVE-2025-27451EPSS 0.4%