High severity · published Jul 3, 2025
CVE-2025-27459
No description published yet
7.5
CVSS
0.2%
EPSS
No
On KEV
Description
The VNC application stores its passwords encrypted within the registry but uses DES for encryption. As DES is broken, the original passwords can be recovered.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EM
Endress+Hauser MEAC300-FNADE4 · Endress+Hauser
vers:all/* · source: vendor
MF
Meac300-fnade4 Firmware · Endress
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-27459
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-27459
Vendor Advisory
https://sick.com/psirt
US Government Resource
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
Product
https://www.endress.com
Not Applicable
https://www.first.org/cvss/calculator/3.1
Third Party Advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json
Third Party Advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
More from Endress+Hauser MEAC300-FNADE4
9.8
CVE-2025-27456
No description published yet
9.8
CVE-2025-27449
No description published yet
9.8
CVE-2025-1710
No description published yet
7.5
CVE-2025-27458
No description published yet
7.5
CVE-2025-27457
No description published yet