CVE-2025-9495
BaseFortify
Publication date: 2025-09-23
Last updated on: 2025-09-24
Assigner: Carrier Global Corporation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| carrier | vitogate_300 | 4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-602 | The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Vitogate 300 web interface does not properly enforce server-side authentication and instead relies on authentication controls implemented on the frontend. This means an attacker can manipulate the HTML elements in their browser's developer tools to bypass login restrictions. By removing certain UI elements, the attacker can access the hidden administration menu and gain full control over the device.
How can this vulnerability impact me? :
This vulnerability allows an attacker to bypass authentication and gain full administrative control over the Vitogate 300 device. This could lead to unauthorized access, manipulation of device settings, potential disruption of services, and compromise of any data or systems connected to the device.