CVE-2025-25265

CWE-306 — Missing AuthenticationCWE-9134 documents4 sources
Severity
4.9MEDIUM
EPSS
0.2%
top 52.97%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
13
Wago Cc100 0751-9x01Wago Edge Controller 0752-8303/8000-0002Wago Pfc100 G1 0750-810x/xxxx-xxxx+10 more
Timeline
PublishedJun 16

Description

A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged remote attacker to read files from the system’s file structure.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitability: 1.2 | Impact: 3.6

Affected Packages13 packages

▶CVEListV5wago/edge_controller_0752-8303/8000-00020.0.0 — 04.07.01 (FW29)+1
▶CVEListV5wago/cc100_0751-9x010.0.0 — 04.07.01 (70)
▶CVEListV5wago/wago_cc100_0751-9x010.0.0 — 04.07.01 (FW29)
▶CVEListV5wago/tp600_0762-420x/8000-000x0.0.0 — 04.07.01 (FW29)+1
▶CVEListV5wago/tp600_0762-430x/8000-000x0.0.0 — 04.07.01 (FW29)+1

🔴Vulnerability Details

2
CVEList
Unauthenticated File Read via Web Interface↗2025-06-16
▶
GHSA
GHSA-62rm-vcwg-chv2: A web application for configuring the controller is accessible at a specific path↗2025-06-16
▶

📋Vendor Advisories

1
Microsoft
In the Linux kernel through 5.16.10 certain binary files may have the exec-all attribute if they were built in approximately 2003 (e.g. with GCC 3.2.2 and Linux kernel 2.4.20). This can cause executio↗2022-02-08
▶
CVE-2025-25265 (MEDIUM CVSS 4.9) | A web application for configuring t | cvebase.io