VulnerabilityAnalyzed
CVE-2025-27460
This allows an attacker with physical access to the device to use an alternative operating system to interact with the hard drives, completely circumventing the Windows login.
MEDIUM 6.8EPSS 0.11%
Does this matter?
Lower severity and a low EPSS score (0.11%). Track it; it rarely justifies an emergency change on its own.
Description
The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the device to use an alternative operating system to interact with the hard drives, completely circumventing the Windows login. The attacker can read from and write to all files on the hard drives.
- CVSS 3.1
- 6.8 MEDIUMCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.11% probability · 2th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-312, CWE-326
- Affected
- endress/meac300-fnade4 firmware
- Source
- psirt@sick.de
References
- https://sick.com/psirtVendor Advisory
- https://sick.com/psirtVendor Advisory
- https://sick.com/psirtVendor Advisory
- https://sick.com/psirtVendor Advisory
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practicesUS Government Resource
- https://www.endress.comProduct
- https://www.first.org/cvss/calculator/3.1Not Applicable
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.jsonVendor Advisory
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdfVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.