CVE-2025-27450
📋 TL;DR
This vulnerability in the MEAC300-FNADE4 device allows session hijacking because cookies lack the Secure attribute. Attackers can intercept PHPSESSID cookies via unencrypted HTTP connections, potentially gaining unauthorized access. Industrial control systems using this SICK device are affected.
💻 Affected Systems
- SICK MEAC300-FNADE4
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full session takeover leading to unauthorized control of industrial processes, data manipulation, or operational disruption in critical infrastructure.
Likely Case
Session hijacking allowing unauthorized access to device configuration interfaces, potentially leading to data exposure or limited system manipulation.
If Mitigated
Minimal impact if HTTPS-only connections are enforced and network segmentation isolates the device from untrusted networks.
🎯 Exploit Status
Exploitation requires tricking users to HTTP connection or intercepting network traffic; no authentication needed for cookie interception
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown specific version; check SICK PSIRT for details
Vendor Advisory: https://sick.com/psirt
Restart Required: Yes
Instructions:
1. Check SICK PSIRT for specific patch version. 2. Apply firmware update from SICK. 3. Restart device. 4. Verify Secure attribute is set on all cookies.
🔧 Temporary Workarounds
Enforce HTTPS Only
allConfigure web server to redirect all HTTP traffic to HTTPS and disable HTTP access
Device-specific configuration via web interface
Network Segmentation
allIsolate device in separate VLAN with strict access controls
Switch/router configuration commands vary by vendor
🧯 If You Can't Patch
- Deploy network-level SSL/TLS termination proxy that adds Secure flag to cookies
- Implement strict network access controls and monitor for HTTP connection attempts
🔍 How to Verify
Check if Vulnerable:
Inspect browser developer tools or use curl: check if PHPSESSID cookie lacks 'Secure' attribute when accessing deviceCheck Version:
Check device web interface for firmware version or use SICK configuration toolsVerify Fix Applied:
Verify cookies now include 'Secure' attribute and HTTP redirects to HTTPS📡 Detection & Monitoring
Log Indicators:
- HTTP connection attempts to device IP
- Multiple session creations from different IPs
- Failed authentication attempts after session establishment
Network Indicators:
- Unencrypted HTTP traffic to device on port 80
- Cookie headers without Secure flag in packet captures
SIEM Query:
source_ip="device_ip" AND (protocol="HTTP" OR port=80) AND (cookie="PHPSESSID" AND NOT cookie="Secure")🔗 References
- https://sick.com/psirt
- https://sick.com/psirt
- https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
- https://www.endress.com
- https://www.first.org/cvss/calculator/3.1
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.json
- https://www.sick.com/.well-known/csaf/white/2025/sca-2025-0008.pdf
