CVE-2025-1711 - Vulnerability Details - OpenCVE

Multiple services of the DUT as well as different scopes of the same service reuse the same credentials.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00047.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Fixes

Solution

Customers are strongly advised to update to the newest version.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://sick.com/psirt
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
https://www.endress.com
https://www.first.org/cvss/calculator/3.1
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json
https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf

History

Thu, 03 Jul 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 03 Jul 2025 11:30:00 +0000

Type	Values Removed	Values Added
Description		Multiple services of the DUT as well as different scopes of the same service reuse the same credentials.
Title		CVE-2025-1711
Weaknesses		CWE-1392
References		https://sick.com/psirt https://www.cisa.gov/resources-tools/resources/ics-recommended-practices https://www.endress.com https://www.first.org/cvss/calculator/3.1 https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: SICK AG

Published: 2025-07-03T11:22:09.710Z

Updated: 2025-07-03T13:16:47.136Z

Reserved: 2025-02-26T08:40:09.909Z

Link: CVE-2025-1711

Vulnrichment

Updated: 2025-07-03T13:04:22.613Z

NVD

Status : Awaiting Analysis

Published: 2025-07-03T12:15:22.270

Modified: 2025-07-03T15:13:53.147

Link: CVE-2025-1711

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-1711", "assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "state": "PUBLISHED", "assignerShortName": "SICK AG", "dateReserved": "2025-02-26T08:40:09.909Z", "datePublished": "2025-07-03T11:22:09.710Z", "dateUpdated": "2025-07-03T13:16:47.136Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Endress+Hauser MEAC300-FNADE4", "vendor": "Endress+Hauser", "versions": [{"lessThanOrEqual": "<=0.16.0", "status": "affected", "version": "0", "versionType": "custom"}]}, {"defaultStatus": "affected", "product": "Endress+Hauser MEAC300-FNADE4", "vendor": "Endress+Hauser", "versions": [{"status": "unaffected", "version": ">=0.17.0", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Multiple services of the DUT as well as different scopes of the same service reuse the same credentials. </p>"}], "value": "Multiple services of the DUT as well as different scopes of the same service reuse the same credentials."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "environmentalScore": 4.3, "environmentalSeverity": "MEDIUM", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "temporalScore": 4.3, "temporalSeverity": "MEDIUM", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1392", "description": "CWE-1392 Use of Default Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "shortName": "SICK AG", "dateUpdated": "2025-07-03T11:22:09.710Z"}, "references": [{"tags": ["x_Endress+Hauser"], "url": "https://www.endress.com"}, {"tags": ["x_SICK PSIRT Security Advisories"], "url": "https://sick.com/psirt"}, {"tags": ["x_ICS-CERT recommended practices on Industrial Security"], "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"}, {"tags": ["x_CVSS v3.1 Calculator"], "url": "https://www.first.org/cvss/calculator/3.1"}, {"tags": ["x_The canonical URL."], "url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json"}, {"tags": ["vendor-advisory"], "url": "https://sick.com/psirt"}, {"tags": ["vendor-advisory"], "url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Customers are strongly advised to update to the newest version.</p>"}], "value": "Customers are strongly advised to update to the newest version."}], "source": {"advisory": "SCA-2025-0008", "discovery": "INTERNAL"}, "title": "CVE-2025-1711", "x_generator": {"engine": "csaf2cve 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-03T12:59:52.915568Z", "id": "CVE-2025-1711", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-03T13:16:47.136Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1711", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-03T12:59:52.915568Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-03T13:04:22.613Z"}}], "cna": {"title": "CVE-2025-1711", "source": {"advisory": "SCA-2025-0008", "discovery": "INTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "temporalScore": 4.3, "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "temporalSeverity": "MEDIUM", "availabilityImpact": "NONE", "environmentalScore": 4.3, "privilegesRequired": "LOW", "confidentialityImpact": "LOW", "environmentalSeverity": "MEDIUM"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Endress+Hauser", "product": "Endress+Hauser MEAC300-FNADE4", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "<=0.16.0"}], "defaultStatus": "unaffected"}, {"vendor": "Endress+Hauser", "product": "Endress+Hauser MEAC300-FNADE4", "versions": [{"status": "unaffected", "version": ">=0.17.0", "versionType": "custom"}], "defaultStatus": "affected"}], "solutions": [{"lang": "en", "value": "Customers are strongly advised to update to the newest version.", "supportingMedia": [{"type": "text/html", "value": "<p>Customers are strongly advised to update to the newest version.</p>", "base64": false}]}], "references": [{"url": "https://www.endress.com", "tags": ["x_Endress+Hauser"]}, {"url": "https://sick.com/psirt", "tags": ["x_SICK PSIRT Security Advisories"]}, {"url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices", "tags": ["x_ICS-CERT recommended practices on Industrial Security"]}, {"url": "https://www.first.org/cvss/calculator/3.1", "tags": ["x_CVSS v3.1 Calculator"]}, {"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json", "tags": ["x_The canonical URL."]}, {"url": "https://sick.com/psirt", "tags": ["vendor-advisory"]}, {"url": "https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "csaf2cve 0.2.0"}, "descriptions": [{"lang": "en", "value": "Multiple services of the DUT as well as different scopes of the same service reuse the same credentials.", "supportingMedia": [{"type": "text/html", "value": "<p>Multiple services of the DUT as well as different scopes of the same service reuse the same credentials. </p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1392", "description": "CWE-1392 Use of Default Credentials"}]}], "providerMetadata": {"orgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "shortName": "SICK AG", "dateUpdated": "2025-07-03T11:22:09.710Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1711", "state": "PUBLISHED", "dateUpdated": "2025-07-03T13:16:47.136Z", "dateReserved": "2025-02-26T08:40:09.909Z", "assignerOrgId": "a6863dd2-93fc-443d-bef1-79f0b5020988", "datePublished": "2025-07-03T11:22:09.710Z", "assignerShortName": "SICK AG"}, "dataVersion": "5.1"}