CVE-2025-25264

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-942

Affected software

Vendor	Product	Versions
WAGO	CC100 0751-9x01	>= 0.0.0, < 04.07.01 (FW29)
WAGO	CC100 0751-9x01	>= 0.0.0, < 04.07.01 (70
WAGO	PFC100 G1 0750-810x/xxxx-xxxx	>= 0.0.0, < 3.10.11 (FW22 Patch 2)
WAGO	PFC100 G2 0750-811x-xxxx-xxxx	>= 0.0.0, < 04.07.01 (70)
WAGO	PFC200 G1 750-820x-xxx-xxx	>= 0.0.0, < 3.10.11 (FW22 Patch 2)
WAGO	PFC200 G2 750-821x-xxx-xxx	>= 0.0.0, < 04.07.01 (FW29)
WAGO	PFC200 G2 750-821x-xxx-xxx	>= 0.0.0, < 04.07.01 (70)
WAGO	TP600 0762-420x/8000-000x	>= 0.0.0, < 04.07.01 (FW29)
WAGO	TP600 0762-420x/8000-000x	>= 0.0.0, < 04.07.01 (70)
WAGO	TP600 0762-430x/8000-000x	>= 0.0.0, < 04.07.01 (FW29)
WAGO	TP600 0762-430x/8000-000x	>= 0.0.0, < 04.07.01 (70)
WAGO	TP600 0762-520x/8000-000x	>= 0.0.0, < 04.07.01 (FW29)
WAGO	TP600 0762-520x/8000-000x	>= 0.0.0, < 04.07.01 (70)
WAGO	TP600 0762-530x/8000-000x	>= 0.0.0, < 04.07.01 (FW29)
WAGO	TP600 0762-530x/8000-000x	>= 0.0.0, < 04.07.01 (70)
WAGO	TP600 0762-620x/8000-000x	>= 0.0.0, < 04.07.01 (FW29)
WAGO	TP600 0762-620x/8000-000x	>= 0.0.0, < 04.07.01 (70)
WAGO	TP600 0762-630x/8000-000x	>= 0.0.0, < 04.07.01 (FW29)
WAGO	TP600 0762-630x/8000-000x	>= 0.0.0, < 04.07.01 (70)
WAGO	Edge Controller 0752-8303/8000-0002	>= 0.0.0, < 04.07.01 (FW29)
WAGO	Edge Controller 0752-8303/8000-0002	>= 0.0.0, < 04.07.01 (70)

References

https://certvde.com/en/advisories/VDE-2025-018/

Timeline

Published: Jun 16, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-252654.9A web application for configuring the controller is accessible at a specific path. It contains an endpoint that allows a high privileged rem CVE-2025-252666.1A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All CVE-2025-252675.5A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All CVE-2025-252688.8An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write ac CVE-2025-252698.4An unauthenticated local attacker can inject a command that is subsequently executed as root, leading to a privilege escalation.CVE-2025-25274.3Mattermost versions 10.5.x <= 10.5.2, 9.11.x <= 9.11.11 failed to properly verify a user's permissions when accessing groups, which allows a CVE-2025-252709.8An unauthenticated remote attacker can alter the device configuration in a way to get remote code execution as root with specific configurat CVE-2025-252718.8An unauthenticated adjacent attacker is able to configure a new OCPP backend, due to insecure defaults for the configuration interface.CVE-2025-252737.8Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow a CVE-2025-252748.8Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allo CVE-2025-252766.5An unauthenticated attacker can hijack other users' devices and potentially control them.CVE-2025-252777.0in OpenHarmony v5.1.0 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through using incompatible ty