CVE-2025-25264

published 2025-06-16

CVE-2025-25264: An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy…

Priority P3 35 medium 6.5 CVSS 3.1

AV N AC L PR N UI R S U C H I N A N

An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.

Affected

21 ranges

Vendor	Product	Version range	Fixed in
wago	cc100_0751-9x01	>= 0.0.0 < 04.07.01 (FW29)	04.07.01 (FW29)
wago	cc100_0751-9x01	>= 0.0.0 < 04.07.01 (70	04.07.01 (70
wago	edge_controller_0752-8303_8000-0002	>= 0.0.0 < 04.07.01 (FW29)	04.07.01 (FW29)
wago	edge_controller_0752-8303_8000-0002	>= 0.0.0 < 04.07.01 (70)	04.07.01 (70)
wago	pfc100_g1_0750-810x_xxxx-xxxx	>= 0.0.0 < 3.10.11 (FW22 Patch 2)	3.10.11 (FW22 Patch 2)
wago	pfc100_g2_0750-811x-xxxx-xxxx	>= 0.0.0 < 04.07.01 (70)	04.07.01 (70)
wago	pfc200_g1_750-820x-xxx-xxx	>= 0.0.0 < 3.10.11 (FW22 Patch 2)	3.10.11 (FW22 Patch 2)
wago	pfc200_g2_750-821x-xxx-xxx	>= 0.0.0 < 04.07.01 (FW29)	04.07.01 (FW29)
wago	pfc200_g2_750-821x-xxx-xxx	>= 0.0.0 < 04.07.01 (70)	04.07.01 (70)
wago	tp600_0762-420x_8000-000x	>= 0.0.0 < 04.07.01 (FW29)	04.07.01 (FW29)
wago	tp600_0762-420x_8000-000x	>= 0.0.0 < 04.07.01 (70)	04.07.01 (70)
wago	tp600_0762-430x_8000-000x	>= 0.0.0 < 04.07.01 (FW29)	04.07.01 (FW29)
wago	tp600_0762-430x_8000-000x	>= 0.0.0 < 04.07.01 (70)	04.07.01 (70)
wago	tp600_0762-520x_8000-000x	>= 0.0.0 < 04.07.01 (FW29)	04.07.01 (FW29)
wago	tp600_0762-520x_8000-000x	>= 0.0.0 < 04.07.01 (70)	04.07.01 (70)
wago	tp600_0762-530x_8000-000x	>= 0.0.0 < 04.07.01 (FW29)	04.07.01 (FW29)
wago	tp600_0762-530x_8000-000x	>= 0.0.0 < 04.07.01 (70)	04.07.01 (70)
wago	tp600_0762-620x_8000-000x	>= 0.0.0 < 04.07.01 (FW29)	04.07.01 (FW29)
wago	tp600_0762-620x_8000-000x	>= 0.0.0 < 04.07.01 (70)	04.07.01 (70)
wago	tp600_0762-630x_8000-000x	>= 0.0.0 < 04.07.01 (FW29)	04.07.01 (FW29)
wago	tp600_0762-630x_8000-000x	>= 0.0.0 < 04.07.01 (70)	04.07.01 (70)

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-942