Read the docs
TI-2025-01473 Aliases CVE-2025-1711GHSA-rxcp-3vrp-9452

Multiple services of the DUT as well as different scopes of the same service reuse the…

Priority LOW 33CWE-1392Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Multiple services of the DUT as well as different scopes of the same service reuse the same credentials.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00397 34th percentileScored 2026-11-07
Fix Fixed Endress+Hauser MEAC300-FNADE4 (Endress+Hauser): >=0.17.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Endress+HauserEndress+Hauser MEAC300-FNADE4up to <=0.16.0—No fix listedCNA
Endress+HauserEndress+Hauser MEAC300-FNADE4—>=0.17.0Patch availableCNA
  • Endress+Hauser MEAC300-FNADE4 VendorEndress+Hauser Affected up to <=0.16.0 Fixed in — No fix listed CNA
  • Endress+Hauser MEAC300-FNADE4 VendorEndress+Hauser Affected — Fixed in >=0.17.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:endress:meac300-fnade4_firmware:*:*:*:*:*:*:*:*up to 0.16.0VulnerableEndress
cpe:2.3:h:endress:meac300-fnade4:-:*:*:*:*:*:*:*not specified by NVDRunning onEndress
  • cpe:2.3:o:endress:meac300-fnade4_firmware:*:*:*:*:*:*:*:* Versions up to 0.16.0 Vulnerable ·Endress
  • cpe:2.3:h:endress:meac300-fnade4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Endress

Remediation

  • Fix · CNA Endress+Hauser MEAC300-FNADE4 (Endress+Hauser) Fixed in >=0.17.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Endress+Hauser MEAC300-FNADE4 — sick.com/psirt

    19 records Highest priority Priority MEDIUM 4 MEDIUM, 15 LOW

    Other records, highest priority first

    • TI-2025-20291 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    • TI-2025-20284 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    • TI-2025-01472 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    Show all 19 records → Advisory →
  • Advisory ·

    Endress+Hauser MEAC300-FNADE4 — sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf

    19 records Highest priority Priority MEDIUM 4 MEDIUM, 15 LOW

    Other records, highest priority first

    • TI-2025-20291 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    • TI-2025-20284 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    • TI-2025-01472 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    Show all 19 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-1711
  2. 2026-10-03 Alias added: GHSA-rxcp-3vrp-9452

References

Advisory 3

Other 3

  • TI-2024-06118 Endress+Hauser: Multiple products are vulnerable to code injection CVSS 3.1CRITICAL 9.8
  • TI-2025-20291 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
  • TI-2025-20284 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
  • TI-2025-01472 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
  • TI-2025-01470 SQL injection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1HIGH 8.6
  • TI-2024-08118 Missing authentication in SICK AG MSC800 CVSS 3.1HIGH 7.5
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences