CVE-2025-27453: Medium severity Endress Meac300-fnade4 Firmware vulnerability
Published Jul 3, 2025
·Updated
The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such as JavaScript.
Affected Software
2 affected components
All of the following
Endress Meac300-fnade4 Firmware<=0.16.0
Endress Meac300-fnade4
Remediation
Information
Customers are strongly advised to update to the newest version.
Event History
Jul 3, 2025
CVE Published
via MITRE·11:29 AM
Data Sourced
via MITRE·11:29 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·12:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-27453?
CVE-2025-27453 is considered a critical vulnerability due to the exposure of the PHPSESSION cookie to potential theft via JavaScript.
2
How do I fix CVE-2025-27453?
To fix CVE-2025-27453, ensure that the HttpOnly flag is set to true on the PHPSESSION cookie.
3
Who is affected by CVE-2025-27453?
CVE-2025-27453 affects users running Endress Meac300-fnade4 Firmware versions up to 0.16.0.
4
What are the risks associated with CVE-2025-27453?
The risks of CVE-2025-27453 include the potential for session hijacking and unauthorized access to user sessions.
5
Is there a patch available for CVE-2025-27453?
Yes, a patch should be applied to set the HttpOnly flag on the PHPSESSION cookie to mitigate CVE-2025-27453.