CVE-2025-27452

The configuration of the Apache httpd webserver which serves the MEAC300-FNADE4 web application, is partly insecure. There are modules activated that are not required for the operation of the FNADE4 web application. The functionality of the some modules pose a risk to the webserver which enable dircetory listing.

• CWE-548

• https://sick.com/psirtVendor Advisory
• https://sick.com/psirtVendor Advisory
• https://sick.com/psirtVendor Advisory
• https://sick.com/psirtVendor Advisory
• https://www.cisa.gov/resources-tools/resources/ics-recommended-practicesUS Government Resource
• https://www.endress.comProduct
• https://www.first.org/cvss/calculator/3.1Not Applicable
• https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.jsonVendor Advisory
• https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdfVendor Advisory

Published

Jul 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-27447The web application is susceptible to cross-site-scripting a…6.1
• CVE-2025-27448The web application is susceptible to cross-site-scripting a…5.4
• CVE-2025-27449The MEAC300-FNADE4 does not implement sufficient measures to…9.8
• CVE-2025-2745A cross-site scripting vulnerability exists in AVEVA PI Web …6.5
• CVE-2025-27450The Secure attribute is missing on multiple cookies provided…6.5
• CVE-2025-27451For failed login attempts, the application returns different…5.3
• CVE-2025-27453The HttpOnly flag is set to false on the PHPSESSION cookie. …6.5
• CVE-2025-27454The application is vulnerable to cross-site request forgery.…4.3
• CVE-2025-27455The web application is vulnerable to clickjacking attacks. T…6.1
• CVE-2025-27456The SMB server's login mechanism does not implement sufficie…9.8
• CVE-2025-27457All communication between the VNC server and client(s) is un…7.5
• CVE-2025-27458The VNC authentication mechanism bases on a challenge-respon…7.5