CVE-2025-27450CWE-614

CVE-2025-27450

Medium · published July 3, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
21.9
In the wild
Unconfirmed
What it is

The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4. An attacker can trick a user to establish an unencrypted HTTP connection to the server and intercept the request containing the PHPSESSID cookie.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00303 · 21.9th percentile
Weakness
CWE-614 · Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
Published
2025-07-03T11:26Z
EPSS history
Timeline
  • 03 JUL 11:26Z
    CVE-2025-27450
    cvelistv5