CVE-2025-27452: meac300-fnade4 — Fix

Description

The configuration of the Apache httpd webserver which serves the MEAC300-FNADE4 web application, is partly insecure. There are modules activated that are not required for the operation of the FNADE4 web application. The functionality of the some modules pose a risk to the webserver which enable dircetory listing.

Is your site exposed to CVE-2025-27452?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

5.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness Type (CWE)

CWE-548 CWE-548

Affected Products

Vendor	Product	Versions
endress	meac300-fnade4_firmware	< 0.16.0
endress	meac300-fnade4	All

References

Advisories & Patches

https://sick.com/psirt https://sick.com/psirt https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf

Other References

https://www.cisa.gov/resources-tools/resources/ics-recommended-practices https://www.endress.com https://www.first.org/cvss/calculator/3.1

Frequently Asked Questions

What is CVE-2025-27452? +

The configuration of the Apache httpd webserver which serves the MEAC300-FNADE4 web application, is partly insecure. There are modules activated that are not required for the operation of the FNADE4 web application. The functionality of the some modules pose a risk to the webserver which enable dircetory listing. It has a CVSS v3.1 base score of 5.3 (MEDIUM).

How severe is CVE-2025-27452? +

CVE-2025-27452 has a CVSS v3.1 score of 5.3 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-27452? +

CVE-2025-27452 affects products from endress, specifically: meac300-fnade4, meac300-fnade4_firmware. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-27452? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2025-28170 7.6

Grandstream Networks GXP1628 <=1.0.4.130 is vulnerable to Incorrect Access Control. The device is configured with directory listing enabled, allowing unauthorized …

CVE-2023-51948 7.5

A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the …

CVE-2022-50788 7.5

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive log files. Attackers can directly …

CVE-2025-32750 7.5

Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with remote access …

CVE-2021-47718 7.5

OpenBMCS 2.4 contains an information disclosure vulnerability that allows unauthenticated attackers to access sensitive files by exploiting directory listing functionality. …

CVE-2023-49979 7.5

A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the application …

CVE-2025-27452