Medium severity · published Jul 3, 2025
CVE-2025-27453
No description published yet
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such as JavaScript.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Endress+Hauser MEAC300-FNADE4 · Endress+Hauser
through <=0.16.0 · source: vendor
MF
Meac300-fnade4 Firmware · Endress
through 0.16.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27453
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27453
Vendor Advisory
https://sick.com/psirt
US Government Resource
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Product
https://www.endress.com
Not Applicable
https://www.first.org/cvss/calculator/3.1
Vendor Advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json
Vendor Advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
More from Endress+Hauser MEAC300-FNADE4
9.8
CVE-2025-27456
No description published yet
9.8
CVE-2025-27449
No description published yet
9.8
CVE-2025-1710
No description published yet
7.5
CVE-2025-27459
No description published yet
7.5
CVE-2025-27458
No description published yet