medium5.3
CVE-2025-27453
The HttpOnly flag is set to false on the PHPSESSION cookie.
Impact
The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such as JavaScript.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Endress | Meac300-Fnade4 Firmware | through 0.16.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://sick.com/psirt
- https://sick.com/psirt
- https://sick.com/psirt
- https://sick.com/psirt
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
- https://www.endress.com
- https://www.first.org/cvss/calculator/3.1
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf