CVE-2025-27456 is a high severity (CVSS 7.5) flaw in the SMB server of the Endress+Hauser MEAC300-FNADE4: its login does not limit repeated failed attempts, so credentials can be guessed. Check the SICK PSIRT advisory for the fixed firmware, and block SMB access to the device from untrusted networks.
What's affected
The record lists the Endress+Hauser MEAC300-FNADE4 and its firmware as affected. The record says the SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame. SMB is the Windows file sharing protocol, so the exposed surface is the device's file share login.
The record points to the SICK product security page (the CNA is SICK PSIRT) and to the CISA recommended practices for industrial control systems. It does not give a fixed firmware version in the data we hold, so the PSIRT advisory is the place to confirm one.
Severity in the record: high, CVSS 7.5, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. Weakness classes: CWE-307 (Improper restriction of excessive authentication attempts).
How to check if you're exposed
This is a device, not a package, so there is no dependency to query.
- Find every MEAC300-FNADE4 unit in your asset list, including ones in plant networks that your IT inventory may not cover.
- Read the firmware version on the device and compare it with the fixed version named in the vendor advisory at sick.com/psirt.
- Establish which network segments can reach the device. The vector says the attack runs over the network with low complexity and no login.
- Look at authentication logs on the device, if it keeps them, and at network logs for repeated login attempts from one source.
What to do now
- Confirm the fixed firmware version in the SICK PSIRT advisory and schedule the update with the plant owner.
- Until then, make sure the device is not reachable from the internet and is reachable inside the plant network only from the hosts that need it.
- Follow the CISA industrial control systems recommended practices linked in the record: segment the control network, use a VPN for remote access, and keep management interfaces off general networks.
- Use strong, unique credentials on the device and change any default or shared ones.
- Add alerting for bursts of failed logins against the device from a single address.
- Record the unit, version and decision in your risk register so the next audit finds a clear answer.
Why it matters
CWE-307 is the absence of a limit on repeated failed login attempts. Without a lockout, delay or rate limit, an attacker can try passwords as fast as the network allows, and a weak or reused password will eventually fall. SMB logins are a common brute force target, which is one more reason never to expose SMB beyond the segment that needs it. The sibling CVE-2025-27449 covers the same missing control elsewhere on the product.
The score is 7.5 because the vector shows high impact on confidentiality only: a successful guess would expose what the account can read. No integrity or availability impact is scored. Industrial devices are often installed once and left for years, so a missing control like this can stay open long after it is public.
The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.
Quick check
Is CVE-2025-27456 a software library issue?
No. It is a weakness in the login handling of an Endress+Hauser device and its firmware, so the response is firmware updates and network controls rather than a dependency upgrade.
Does CVE-2025-27456 give an attacker control of the device?
The vector scores high confidentiality impact and no integrity or availability impact, so the record describes disclosure of information, not takeover. Read the vendor advisory for the exact effect on your model.
Sources
Last reviewed: 19 October 2026.
