CVE-2025-27460: endress+hauser endress+hauser meac300-fnade4
Vulnerability summary
CVE-2025-27460 is a high (CVSS 7.6) vulnerability in endress+hauser endress+hauser meac300-fnade4. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.3% of scored vulnerabilities.
Timeline
- 03-07-2025PublishedVulnerability first disclosed.
- 03-07-2025Last modifiedVulnerability information updated.
Description
The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the device to use an alternative operating system to interact with the hard drives, completely circumventing the Windows login. The attacker can read from and write to all files on the hard drives.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.8MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HDiffers
EPSS trend
Probability
0.13%
Chance of exploitation in the next 30 days
Percentile
2%
Versus all other CVEs
30-day change
+0.02 pp
From 0.11% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
- CWE-326Inadequate Encryption StrengthThe product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Affected systems
Endress+hauser1 product
- endress+hauser meac300-fnade4vers:all/*
1 vendor · 1 product
References
6 links
www.cisa.gov/resources-tools/resources/ics-recommended-practicesX ICS CERT Recommended Practices On Industrial SecurityUS Government Resource- www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdfVendor Advisory