CVE-2025-27451: Medium severity Endress Meac300-fnade4 Firmware vulnerability
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27451?
CVE-2025-27451 is considered a medium severity vulnerability due to its potential for user enumeration attacks.
How do I fix CVE-2025-27451?
To fix CVE-2025-27451, implement consistent error messages for failed login attempts that do not reveal whether the username or password is incorrect.
Which software is affected by CVE-2025-27451?
CVE-2025-27451 affects Endress Meac300-fnade4 Firmware versions up to and including 0.16.0.
What is the impact of CVE-2025-27451?
The impact of CVE-2025-27451 is that it allows attackers to systematically guess existing usernames, potentially leading to unauthorized access.
Is there a workaround for CVE-2025-27451?
A potential workaround for CVE-2025-27451 is to temporarily implement rate limiting on login attempts to help mitigate the attack.