CVE-2025-27461 Overview
CVE-2025-27461 affects the Endress MEAC300-FNADE4 emission monitoring controller. During system startup, the device automatically logs in the EPC2 Windows user account without prompting for a password. An attacker with physical access to the device can obtain an interactive Windows session and operate under the EPC2 user context. The weakness is classified as Missing Authorization [CWE-862] and impacts both firmware and hardware variants of the MEAC300-FNADE4 product line distributed by SICK.
Critical Impact
Physical attackers gain an authenticated Windows session on the emission monitoring controller without providing credentials, exposing sensitive process data and control functionality.
Affected Products
- Endress MEAC300-FNADE4 hardware appliance
- Endress MEAC300-FNADE4 firmware (all versions listed in SICK advisory SCA-2025-0008)
- Deployments using the default EPC2 Windows user profile
Discovery Timeline
- 2025-07-03 - CVE-2025-27461 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-27461
Vulnerability Analysis
The MEAC300-FNADE4 is an industrial emission monitoring controller that runs a Windows-based operating environment. On boot, the system is configured to automatically authenticate the EPC2 Windows user account without presenting a login prompt. This design skips the standard credential verification step required to establish an interactive user session.
An attacker who physically accesses the device, either at the console or through a connected keyboard and display, receives an active desktop session as EPC2. From that session, the attacker can read local files, launch applications, and interact with the monitoring software using whatever privileges the EPC2 account holds. The exposure is directly proportional to the permissions assigned to that Windows account.
The issue is tracked under CWE-862: Missing Authorization. The system fails to perform an authorization check that verifies the operator is entitled to access the interactive session.
Root Cause
The root cause is an insecure default configuration. The device ships with Windows auto-logon enabled for the EPC2 account, and no secondary authorization gate protects the desktop after boot. Details are documented in the SICK CSAF PDF Advisory.
Attack Vector
Exploitation requires physical proximity to the MEAC300-FNADE4 device. An attacker powers on or reboots the appliance, waits for Windows to complete the automatic logon, and interacts with the resulting EPC2 desktop session. No network access, credentials, or user interaction from a legitimate operator are needed. See the FIRST CVSS Calculator 3.1 for vector interpretation guidance.
Detection Methods for CVE-2025-27461
Indicators of Compromise
- Unexpected interactive logon events for the EPC2 Windows user recorded in the Windows Security event log (Event ID 4624, Logon Type 2 or 11).
- Application launches, USB device insertions, or configuration changes on the MEAC300-FNADE4 outside of scheduled maintenance windows.
- Modifications to emission monitoring data files or reporting outputs that do not correlate with authorized operator activity.
Detection Strategies
- Forward Windows event logs from the MEAC300-FNADE4 to a centralized logging or SIEM platform and alert on interactive EPC2 logons following a device reboot.
- Enable physical tamper detection on device enclosures and correlate tamper alerts with logon activity.
- Review Windows Task Scheduler, Run keys, and Startup folder entries for the EPC2 profile to detect persistence added by an intruder.
Monitoring Recommendations
- Continuously monitor operational technology (OT) network segments for outbound connections originating from the MEAC300-FNADE4 host.
- Track reboot frequency of the device and investigate reboots that occur outside change-control windows.
- Audit file system and registry changes under the C:\Users\EPC2 profile on a recurring schedule.
How to Mitigate CVE-2025-27461
Immediate Actions Required
- Restrict physical access to the MEAC300-FNADE4 by installing it inside a locked cabinet or a controlled equipment room.
- Disable Windows auto-logon for the EPC2 account and require interactive credential entry at boot.
- Reduce the privileges of the EPC2 account to the minimum required for emission monitoring operations.
- Review the SICK PSIRT advisory and apply vendor-recommended hardening steps.
Patch Information
SICK PSIRT tracks this issue under advisory SCA-2025-0008. Refer to the SICK CSAF JSON Advisory and the SICK CSAF PDF Advisory for current remediation guidance, affected firmware versions, and configuration changes. Coordinate any firmware update with the equipment operator to avoid disrupting emission reporting obligations.
Workarounds
- Enforce physical security controls such as door locks, surveillance cameras, and visitor logging around the device.
- Configure a BIOS or UEFI password to prevent unauthorized boot or removable media use.
- Enable BitLocker or an equivalent full-disk encryption solution to protect data at rest if the device is removed.
- Follow the CISA ICS Recommended Practices for defense-in-depth in industrial control environments.
# Disable Windows auto-logon for the EPC2 account (run as administrator)
reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /t REG_SZ /d "0" /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /f
reg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /f
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
