CVE-2025-27453: Endress Meac300-fnade4 XSS Vulnerability

CVE-2025-27453 Overview

CVE-2025-27453 affects the Endress meac300-fnade4 device firmware. The web interface issues a PHPSESSION cookie without setting the HttpOnly flag. As a result, client-side JavaScript running in the browser can read the session cookie through document.cookie.

This weakness is classified under [CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag]. An attacker who can inject or execute script in the context of the web interface can retrieve the session identifier and hijack an authenticated user session. The vulnerability is network-reachable and requires user interaction, typically through a companion cross-site scripting condition or a malicious page.

Critical Impact
Session cookies exposed to JavaScript enable session hijacking, allowing attackers to impersonate authenticated operators of the Endress meac300-fnade4 continuous emission monitoring system.

Affected Products

Endress meac300-fnade4 firmware (all versions listed in the vendor advisory)
Endress meac300-fnade4 hardware appliance
Deployments exposing the device web interface to browser-based operator access

Discovery Timeline

2025-07-03 - CVE-2025-27453 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27453

Vulnerability Analysis

The Endress meac300-fnade4 web application creates a PHP session and returns the PHPSESSION cookie in the Set-Cookie response header. The response omits the HttpOnly attribute. Browsers therefore expose the cookie value to any JavaScript executing in the origin, including scripts loaded through cross-site scripting, malicious extensions, or compromised third-party resources.

Session identifiers are the primary bearer of authentication state in PHP applications. When they are readable from JavaScript, an attacker no longer needs to steal credentials. Capturing the PHPSESSION value is sufficient to replay requests as the victim. The impact is bounded to confidentiality of the session identifier, but that identifier grants full application-level access for its remaining lifetime.

Root Cause

The root cause is a missing security attribute on the session cookie. The application either calls session_start() without hardening session.cookie_httponly in php.ini, or emits Set-Cookie headers manually without appending HttpOnly. Either path leaves the cookie accessible through the Document Object Model (DOM).

Attack Vector

The attack requires network reachability to the device web interface and user interaction. A typical exploitation chain involves luring an authenticated operator to a page under attacker influence, executing JavaScript such as document.cookie to read the PHPSESSION value, and exfiltrating it to an attacker-controlled endpoint. The attacker then replays the cookie against the device to obtain the victim's session.

Refer to the SICK PSIRT advisory SCA-2025-0008 for vendor-published exploitation context.

Detection Methods for CVE-2025-27453

Indicators of Compromise

Set-Cookie response headers from the meac300-fnade4 web interface containing PHPSESSION without an HttpOnly attribute.
Outbound HTTP requests from operator workstations carrying PHPSESSION values in query strings, request bodies, or Referer headers to unknown destinations.
Repeated session activity from IP addresses that differ from the original operator address while the same PHPSESSION value is in use.

Detection Strategies

Inspect HTTP traffic to and from the device web interface and alert on Set-Cookie headers that lack HttpOnly or Secure attributes.
Correlate session identifier reuse across distinct source IP addresses or user-agent strings within short time windows.
Monitor operator endpoints for browser behavior that reads document.cookie and posts data to external hosts, which is characteristic of session-stealing scripts.

Monitoring Recommendations

Log full request and response headers for the device management interface in a centralized store to enable retrospective session hijacking hunts.
Track authentication events and geolocate source addresses to identify implausible session movement.
Alert on any script loaded by the device interface from origins outside the vendor allowlist.

How to Mitigate CVE-2025-27453

Immediate Actions Required

Restrict network access to the meac300-fnade4 web interface so only authorized engineering workstations on segmented operational technology (OT) networks can reach it.
Require operators to close the browser or explicitly log out after each session, invalidating the server-side session record.
Apply the vendor guidance published in the SICK CSAF advisory SCA-2025-0008 as soon as it is available for your firmware version.

Patch Information

Consult the SICK PSIRT portal for the current fixed firmware version and remediation instructions for CVE-2025-27453. Follow CISA ICS recommended practices when scheduling maintenance windows on industrial control systems.

Workarounds

Place the device behind a reverse proxy that rewrites Set-Cookie headers to append HttpOnly and Secure attributes to the PHPSESSION cookie.
Enforce a strict Content Security Policy on the management interface through the reverse proxy to reduce the impact of any cross-site scripting used to read cookies.
Require access to the device management interface through a virtual private network (VPN) or jump host, eliminating exposure to general-purpose browsing sessions.

bash

# Example nginx snippet to append HttpOnly to upstream cookies
proxy_cookie_flags PHPSESSION httponly secure samesite=strict;