CVE-2025-30280: Mendix Runtime Information Disclosure Flaw

CVE-2025-30280 Overview

CVE-2025-30280 affects multiple versions of Siemens Mendix Runtime, a low-code application platform. The vulnerability allows unauthenticated remote attackers to enumerate valid entity names and attribute names in Mendix Runtime-based applications. The flaw stems from distinguishable server responses returned by certain client actions, enabling attackers to differentiate valid identifiers from invalid ones. This weakness is categorized under [CWE-204] Observable Response Discrepancy. While the vulnerability itself does not directly expose data, it provides reconnaissance value for attackers preparing further attacks against the application's data model.

Critical Impact
Unauthenticated remote attackers can enumerate the complete entity and attribute schema of a Mendix Runtime-based application, exposing the internal data model for use in follow-on attacks.

Affected Products

Mendix Runtime V10 (all versions prior to V10.21.0), including V10.6 (< V10.6.22), V10.12 (< V10.12.16), and V10.18 (< V10.18.5)
Mendix Runtime V9 (all versions prior to V9.24.34)
Mendix Runtime V8 (all versions prior to V8.18.35)

Discovery Timeline

2025-04-08 - CVE-2025-30280 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30280

Vulnerability Analysis

The vulnerability resides in the Mendix Runtime's handling of certain client actions. When a client action references an entity or attribute name, the runtime returns a response that varies based on whether the referenced identifier exists. An attacker can compare responses to distinguish valid entity and attribute names from invalid ones. The attack requires no authentication and can be performed remotely over the network. Because Mendix applications typically expose their runtime endpoints to authenticated and anonymous clients alike, the attack surface is broad. Enumeration of the internal data model provides adversaries with a schema map that accelerates targeted attacks against business logic, authorization boundaries, and data endpoints.

Root Cause

The root cause is an observable response discrepancy [CWE-204]. The runtime does not normalize error responses for requests referencing nonexistent entities or attributes, allowing attackers to infer schema information from response differences such as content, timing, or status codes. Uniform error handling for both valid and invalid identifiers would prevent this side-channel disclosure.

Attack Vector

An unauthenticated attacker submits crafted client action requests to the Mendix Runtime endpoint over the network. By iterating candidate entity and attribute names and comparing server responses, the attacker builds a complete inventory of the application's data model. No user interaction is required and no privileges are needed. Refer to the Siemens Security Advisory SSA-874353 for technical details.

Detection Methods for CVE-2025-30280

Indicators of Compromise

High volume of client action requests from a single source containing varied entity or attribute name parameters within a short interval.
Sequential requests probing predictable name patterns such as User, Account, Customer, or common CRUD attributes.
Elevated ratio of error responses to successful responses on Mendix Runtime endpoints from unauthenticated sessions.

Detection Strategies

Instrument Mendix Runtime access logs to flag unauthenticated clients issuing repeated client action requests referencing distinct identifiers.
Deploy web application firewall rules that rate-limit anonymous requests to Mendix client action endpoints.
Correlate response status distributions per source IP to identify enumeration behavior against the application's data model.

Monitoring Recommendations

Forward Mendix Runtime and reverse proxy logs to a centralized SIEM for anomaly detection on request volume and error rates.
Alert on unauthenticated sources generating more than a defined threshold of client action requests within a rolling window.
Review authentication logs for follow-on activity from IPs previously observed enumerating entity or attribute names.

How to Mitigate CVE-2025-30280

Immediate Actions Required

Upgrade Mendix Runtime to a fixed release: V10.21.0 or later, V10.18.5 or later, V10.12.16 or later, V10.6.22 or later, V9.24.34 or later, or V8.18.35 or later.
Inventory all deployed Mendix applications and identify runtime versions to prioritize patching.
Restrict network exposure of Mendix Runtime endpoints to trusted networks where feasible until patching completes.

Patch Information

Siemens has released fixed Mendix Runtime versions addressing CVE-2025-30280. Consult the Siemens Security Advisory SSA-874353 for the complete list of fixed versions and upgrade instructions.

Workarounds

Place Mendix Runtime endpoints behind a web application firewall configured to rate-limit and inspect client action requests.
Enforce authentication on all client actions where the business logic permits, reducing the anonymous attack surface.
Monitor and alert on abnormal error-response patterns indicative of entity enumeration until patches are applied.

bash

# Example rate-limit rule for a reverse proxy fronting Mendix Runtime
# nginx configuration
limit_req_zone $binary_remote_addr zone=mendix_actions:10m rate=10r/s;

location /xas/ {
    limit_req zone=mendix_actions burst=20 nodelay;
    proxy_pass http://mendix_backend;
}