QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2025-27447

Back to search

CVE-2025-27447

Published: Jul 3, 2025

Modified: Jul 3, 2025

PUBLISHED

CVSS v3.1

7.4

HIGH

Description

The web application is susceptible to cross-site-scripting attacks. An attacker can create a prepared URL, which injects JavaScript code into the website. The code is executed in the victim’s browser when an authenticated administrator clicks the link.

VendorProductVersions

Endress+Hauser

Endress+Hauser MEAC300-FNADE4

affected
0 - <= <=0.16.0

Endress+Hauser

Endress+Hauser MEAC300-FNADE4

unaffected
>=0.17.0

Weaknesses (CWE)

CWE-79

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

References

https://www.endress.com
x_Endress+Hauser
https://sick.com/psirt
x_SICK PSIRT Security Advisories
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
x_ICS-CERT recommended practices on Industrial Security
https://sick.com/psirt
vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now