Read the docs
TI-2025-20291 Aliases CVE-2025-27456GHSA-wwhp-85cv-f9cj

Missing brute-force protection in Endress+Hauser MEAC300-FNADE4

Priority MEDIUM 49CWE-307Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-307.

Summary

The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible to brute-force attacks.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00602 49th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Endress+HauserEndress+Hauser MEAC300-FNADE4all versions—No fix listedCNA
  • Endress+Hauser MEAC300-FNADE4 VendorEndress+Hauser Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:endress:meac300-fnade4_firmware:*:*:*:*:*:*:*:*all versionsVulnerableEndress
cpe:2.3:h:endress:meac300-fnade4:-:*:*:*:*:*:*:*not specified by NVDRunning onEndress
  • cpe:2.3:o:endress:meac300-fnade4_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Endress
  • cpe:2.3:h:endress:meac300-fnade4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Endress

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Endress+Hauser MEAC300-FNADE4 — sick.com/psirt

    19 records Highest priority Priority MEDIUM 4 MEDIUM, 15 LOW

    Other records, highest priority first

    • TI-2025-20284 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    • TI-2025-01472 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    • TI-2025-01470 SQL injection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 44
    Show all 19 records → Advisory →
  • Advisory ·

    Endress+Hauser MEAC300-FNADE4 — sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf

    19 records Highest priority Priority MEDIUM 4 MEDIUM, 15 LOW

    Other records, highest priority first

    • TI-2025-20284 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    • TI-2025-01472 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 49
    • TI-2025-01470 SQL injection in Endress+Hauser MEAC300-FNADE4Priority MEDIUM 44
    Show all 19 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-27456
  2. 2026-10-03 Alias added: GHSA-wwhp-85cv-f9cj

References

Advisory 3

Other 3

  • TI-2024-06118 Endress+Hauser: Multiple products are vulnerable to code injection CVSS 3.1CRITICAL 9.8
  • TI-2025-20284 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
  • TI-2025-01472 Missing brute-force protection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1CRITICAL 9.8
  • TI-2025-01470 SQL injection in Endress+Hauser MEAC300-FNADE4 CVSS 3.1HIGH 8.6
  • TI-2024-08118 Missing authentication in SICK AG MSC800 CVSS 3.1HIGH 7.5
  • TI-2020-09990 ENDRESS+HAUSER: Ecograph T utilizing Webserver firmware version 1.x has improper privilege management CVSS 3.1CRITICAL 9.1
See all 25 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences