CVE-2025-27450
BaseFortify
Publication date: 2025-07-03
Last updated on: 2026-02-06
Assigner: SICK AG
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| endress | meac300-fnade4_firmware | to 0.16.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-614 | The Secure attribute for sensitive cookies in HTTPS sessions is not set. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability occurs because the Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4 device. Without the Secure attribute, cookies like PHPSESSID can be sent over unencrypted HTTP connections. An attacker can exploit this by tricking a user into connecting to the server via HTTP instead of HTTPS, allowing the attacker to intercept the cookie and potentially hijack the user's session.
How can this vulnerability impact me? :
The vulnerability can lead to session hijacking, where an attacker intercepts the PHPSESSID cookie over an unencrypted connection. This can allow the attacker to impersonate the user and gain unauthorized access to the user's session on the affected device or service.