CVE-2025-27448

5.4 mediumEPSS 0.3%

Medium (5.4) in endress meac300-fnade4 firmware. EPSS 0.3% chance of exploitation in the next 30 days.

The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboards can inject JavaScript code into the dashboard name which will be executed when the website is loaded.

Severity

CVSS 3.1

5.4 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-07-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

endress:meac300-fnade4_firmware

References

https://sick.com/psirt
https://sick.com/psirt
https://sick.com/psirt
https://sick.com/psirt
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

Check your stack JSON