CVE-2025-1708

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The application is vulnerable to SQL injection attacks. An attacker is able to dump the PostgreSQL database and read its content.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
Endress+Hauser	Endress+Hauser MEAC300-FNADE4	<= <=0.16.0
Endress+Hauser	Endress+Hauser MEAC300-FNADE4	—

References

https://sick.com/psirtVendor Advisory
https://sick.com/psirtVendor Advisory
https://sick.com/psirtVendor Advisory
https://sick.com/psirtVendor Advisory
https://www.cisa.gov/resources-tools/resources/ics-recommended-practicesUS Government Resource
https://www.endress.comProduct
https://www.first.org/cvss/calculator/3.1Not Applicable
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.jsonVendor Advisory
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdfVendor Advisory

Timeline

Published: Jul 3, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-17096.5Several credentials for the local PostgreSQL database are stored in plain text (partially base64 encoded).CVE-2025-17109.8The maxView Storage Manager does not implement sufficient measures to prevent multiple failed authentication attempts within a short time fr CVE-2025-17117.5Multiple services of the DUT as well as different scopes of the same service reuse the same credentials.CVE-2025-17128.8Argument injection in special agent configuration in Checkmk <2.4.0p1, <2.3.0p32, <2.2.0p42 and 2.1.0 allows authenticated attackers to writ CVE-2025-17137.5When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream bridge is required. This CVE-2025-17146.9Lack of Rate Limiting in Sign-up workflow in Perforce Gliffy prior to version 4.14.0-7 on Gliffy online allows attacker to enumerate valid u CVE-2025-17169.8picklescan before 0.0.21 does not treat 'pip' as an unsafe global. An attacker could craft a malicious model that uses Pickle to pull in a m CVE-2025-17178.1The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecur CVE-2025-17186.5An authenticated user with file access privilege via FTP access can cause the Relion 670/650 and SAM600-IO series device to reboot due to im CVE-2025-17197.5IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing CVE-2025-17217.5IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing CVE-2025-17227.5IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing