How severe is CVE-2025-27453?

CVE-2025-27453 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2025-27453 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-27453?

CVE-2025-27453 affects Endress Meac300-fnade4 Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-27453?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2025-27453 have an EU (EUVD) identifier?

Yes. CVE-2025-27453 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-19846.

When was CVE-2025-27453 published?

CVE-2025-27453 was published on 2025-07-03 and last updated on 2026-06-17.

CVE-2025-27453

CVE-2025-27453 is a medium-severity vulnerability in Endress Meac300-fnade4 Firmware with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-1004.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (27th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-19846
Weakness: CWE-1004
Affected product: Endress Meac300-fnade4 Firmware
Published: 2025-07-03
Last modified: 2026-06-17

Description

The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such as JavaScript.

Frequently asked questions

What is CVE-2025-27453?: The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such as JavaScript.
How severe is CVE-2025-27453?: CVE-2025-27453 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2025-27453 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (27th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-27453?: CVE-2025-27453 affects Endress Meac300-fnade4 Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-27453?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2025-27453 have an EU (EUVD) identifier?: Yes. CVE-2025-27453 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-19846.
When was CVE-2025-27453 published?: CVE-2025-27453 was published on 2025-07-03 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:endress:meac300-fnade4_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Endress Meac300-fnade4 Firmware

CVE-2025-1708 — High (CVSS 8.6): The application is vulnerable to SQL injection attacks. An attacker is able to dump the PostgreSQL database and read…
CVE-2025-27461 — High (CVSS 7.6): During startup, the device automatically logs in the EPC2 Windows user without requesting a password.
CVE-2025-27460 — High (CVSS 7.6): The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows…
CVE-2025-27456 — High (CVSS 7.5): The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication…
CVE-2025-27449 — High (CVSS 7.5): The MEAC300-FNADE4 does not implement sufficient measures to prevent multiple failed authentication attempts within a…
CVE-2025-1710 — High (CVSS 7.5): The maxView Storage Manager does not implement sufficient measures to prevent multiple failed authentication attempts…

All CVEs affecting Endress Meac300-fnade4 Firmware →

Other CWE-1004 vulnerabilities

CVE-2025-26844 — Critical (CVSS 9.8): An issue was discovered in Znuny through 7.1.3. A cookie is set without the HttpOnly flag.
CVE-2026-22081 — High (CVSS 8.8): This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the…
CVE-2026-42239 — High (CVSS 8.1): Budibase is an open-source low-code platform. Prior to version 3.35.10, the budibase:auth cookie containing the JWT…
CVE-2025-27223 — High (CVSS 7.5): TRUfusion Enterprise through 7.10.4.0 exposes the encrypted COOKIEID as an authentication mechanism for some endpoints…
CVE-2025-24318 — Medium (CVSS 6.8): Cookie policy is observable via built-in browser tools. In the presence of XSS, this could lead to full session…
CVE-2026-0696 — Medium (CVSS 6.5): In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In…

Browse all CWE-1004 vulnerabilities →