Log in Start free

Vulnerability · Published Jul 3, 2025 · Assigned by SICK AG

CVE-2025-27458CVE-2025-27458

Medium 6.5

In plain English

A medium-severity broken cryptography in Endress+Hauser MEAC300-FNADE4 from Endress+Hauser. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 89.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The VNC authentication mechanism bases on a challenge-response system where both server and client use the same password for encryption. The challenge is sent from the server to the client, is encrypted by the client and sent back. The server does the same encryption locally and if the responses match it is prooven that the client knows the correct password. Since all VNC communication is unencrypted, an attacker can obtain the challenge and response and try to derive the password from this information.

Affected products (as reported)

VendorProductVersions
Endress+Hauser Endress+Hauser MEAC300-FNADE4 vers:all/*

Weakness: CWE-327 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References