QwikSec

Security Database

CVE

CWE

Training

CVE-2025-27452

Published: Jul 3, 2025

Modified: Jul 3, 2025

PUBLISHED

CVSS v3.1

5.3

MEDIUM

Description

The configuration of the Apache httpd webserver which serves the MEAC300-FNADE4 web application, is partly insecure. There are modules activated that are not required for the operation of the FNADE4 web application. The functionality of the some modules pose a risk to the webserver which enable dircetory listing.

Vendor	Product	Versions
Endress+Hauser	Endress+Hauser MEAC300-FNADE4	affected `0 - <= <=0.16.0`
Endress+Hauser	Endress+Hauser MEAC300-FNADE4	unaffected `>=0.17.0`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

References

https://www.endress.com

x_Endress+Hauser

https://sick.com/psirt

x_SICK PSIRT Security Advisories

https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

x_ICS-CERT recommended practices on Industrial Security

https://www.first.org/cvss/calculator/3.1

x_CVSS v3.1 Calculator

https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json

x_The canonical URL.

https://sick.com/psirt

vendor-advisory

https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.