CVE-2025-27451 CVE-2025-27451
An attacker can enumerate valid usernames by observing distinct error messages for failed login attempts on the MEAC300 device.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-27451?
CVE-2025-27451 is a medium-severity vulnerability in Endress+Hauser MEAC300-FNADE4, published on 3 Jul 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.
Which versions are affected by CVE-2025-27451?
It affects 1 product.
Products include Endress Meac300-Fnade4 Firmware.
How do I fix CVE-2025-27451?
No fix has been published for CVE-2025-27451 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-27451 being exploited?
There is no known exploitation of CVE-2025-27451 in the wild and no public exploit code.
Other vulnerabilities in Endress+Hauser MEAC300-FNADE4
Sources
Also known as GHSA-6gf6-3j9v-j983.