Read the docs
TI-2025-20290 Aliases CVE-2025-27455GHSA-xfp2-c65p-54x7

Clickjacking in Endress+Hauser MEAC300-FNADE4

Priority LOW 27CWE-1021Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-1021.

Summary

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives, thus potentially revealing confidential information or allowing others to take control of their computer while clicking on seemingly innocuous objects.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00341 27th percentileScored 2026-11-07
Fix Fixed Endress+Hauser MEAC300-FNADE4 (Endress+Hauser): >=0.17.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Endress+HauserEndress+Hauser MEAC300-FNADE4up to <=0.16.0—No fix listedCNA
Endress+HauserEndress+Hauser MEAC300-FNADE4—>=0.17.0Patch availableCNA
  • Endress+Hauser MEAC300-FNADE4 VendorEndress+Hauser Affected up to <=0.16.0 Fixed in — No fix listed CNA
  • Endress+Hauser MEAC300-FNADE4 VendorEndress+Hauser Affected — Fixed in >=0.17.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:endress:meac300-fnade4_firmware:*:*:*:*:*:*:*:*up to 0.16.0VulnerableEndress
cpe:2.3:h:endress:meac300-fnade4:-:*:*:*:*:*:*:*not specified by NVDRunning onEndress
  • cpe:2.3:o:endress:meac300-fnade4_firmware:*:*:*:*:*:*:*:* Versions up to 0.16.0 Vulnerable ·Endress
  • cpe:2.3:h:endress:meac300-fnade4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Endress

Remediation

  • Fix · CNA Endress+Hauser MEAC300-FNADE4 (Endress+Hauser) Fixed in >=0.17.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Endress+Hauser MEAC300-FNADE4 — sick.com/psirt

    19 records Highest priority Priority MEDIUM 4 MEDIUM, 15 LOW

    Other records, highest priority first

    • TI-2025-20291 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    • TI-2025-20284 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    • TI-2025-01472 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    Show all 19 records → Advisory →
  • Advisory ·

    Endress+Hauser MEAC300-FNADE4 — sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf

    19 records Highest priority Priority MEDIUM 4 MEDIUM, 15 LOW

    Other records, highest priority first

    • TI-2025-20291 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    • TI-2025-20284 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    • TI-2025-01472 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    Show all 19 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27455
  2. 2026-10-03 Alias added: GHSA-xfp2-c65p-54x7

References

Advisory 3

Other 3

  • TI-2024-06118 Endress+Hauser: Multiple products are vulnerable to code injection CVSS 3.1CRITICAL 9.8
  • TI-2025-20291 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
  • TI-2025-20284 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
  • TI-2025-01472 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
  • TI-2025-01470 SQL injection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1HIGH 8.6
  • TI-2024-08118 Missing authentication in SICK AG MSC800 CVSS 3.1HIGH 7.5
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences