CVE-2025-27450: MEAC300-FNADE4 Information Disclosure

CVE-2025-27450 Overview

CVE-2025-27450 affects the Endress MEAC300-FNADE4 emission monitoring device. The web interface issues multiple cookies, including the PHPSESSID session cookie, without the Secure attribute. Browsers transmit cookies lacking this attribute over plaintext HTTP as well as HTTPS. An attacker positioned on the network can trick a user into loading an unencrypted HTTP request to the server and intercept the exposed session identifier. Successful interception enables session hijacking against the authenticated user. The weakness is tracked as CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute.

Critical Impact
Interception of the PHPSESSID cookie allows an attacker to hijack an authenticated user session on the MEAC300-FNADE4 management interface.

Affected Products

Endress MEAC300-FNADE4 (hardware)
Endress MEAC300-FNADE4 firmware (all versions listed in vendor advisory)
Industrial emission monitoring deployments exposing the device web interface

Discovery Timeline

2025-07-03 - CVE-2025-27450 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27450

Vulnerability Analysis

The MEAC300-FNADE4 web application sets session and application cookies without the Secure cookie attribute. The Secure attribute instructs the browser to send the cookie only over TLS-encrypted channels. When it is missing, the browser attaches the cookie to any request matching the cookie scope, including plaintext HTTP requests.

An attacker on the same network path can coerce the victim's browser to issue an HTTP request to the device. Techniques include injecting an http:// reference into a page the user visits, sending a crafted link, or performing an on-path downgrade. The intercepted PHPSESSID value is sufficient to impersonate the authenticated user on the MEAC300-FNADE4 interface.

Exploitation requires user interaction and a network position capable of observing traffic to the device. It does not require prior authentication on the target. Confidentiality of the active session is fully compromised, while integrity and availability of the underlying process data are not directly affected by this weakness alone.

Root Cause

The application layer omits the Secure flag when issuing Set-Cookie headers. This is a configuration defect in the web session handler and cookie policy of the device firmware.

Attack Vector

The attack vector is network-based with user interaction. An attacker convinces an authenticated user to trigger an HTTP request to the device, then captures the cookie in transit and replays it against the HTTPS management interface.

No verified proof-of-concept code is published for CVE-2025-27450. See the SICK PSIRT advisory SCA-2025-0008 for vendor technical details.

Detection Methods for CVE-2025-27450

Indicators of Compromise

Plaintext HTTP requests to the MEAC300-FNADE4 device carrying a PHPSESSID cookie value.
Concurrent authenticated sessions from distinct source IP addresses using the same session identifier.
Unexpected configuration or acknowledgement actions originating from IP addresses outside the operations network.

Detection Strategies

Inspect Set-Cookie response headers from the device and flag any cookie issued without the Secure attribute.
Correlate web access logs to identify session identifiers presented from more than one client fingerprint or geolocation.
Alert on any HTTP (port 80) traffic to industrial control assets where policy requires HTTPS only.

Monitoring Recommendations

Capture network flows to and from the MEAC300-FNADE4 management interface and retain them for forensic review.
Monitor operator workstations for browser requests that downgrade from HTTPS to HTTP when contacting OT assets.
Review authentication and audit logs on the device for session reuse anomalies and off-hours activity.

How to Mitigate CVE-2025-27450

Immediate Actions Required

Restrict access to the MEAC300-FNADE4 web interface to a dedicated OT management VLAN with strict ACLs.
Require operators to reach the device only through HTTPS, and block outbound HTTP to the device at the network layer.
Terminate active sessions and rotate operator credentials after applying network controls.

Patch Information

Refer to the SICK PSIRT portal and the machine-readable CSAF advisory SCA-2025-0008 for the current firmware remediation status and fixed version guidance for the MEAC300-FNADE4.

Workarounds

Place the device behind a reverse proxy that rewrites Set-Cookie headers to add the Secure and HttpOnly attributes.
Enforce HSTS on the proxy so that browsers refuse plaintext HTTP requests to the device host.
Segment the device per CISA ICS Recommended Practices, limiting reachability from general-purpose corporate networks.

bash

# Example NGINX reverse proxy snippet enforcing Secure cookies and HSTS
server {
    listen 443 ssl;
    server_name meac300.internal;

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

    location / {
        proxy_pass https://meac300-device.local;
        proxy_cookie_flags ~ secure httponly samesite=strict;
    }
}