PatchTheCVECVE-2025-27451: For failed login attempts, the application returns different error messages depending on whether the login fai
CVE-2025-27451 is a medium-severity flaw (CVSS 5.3) affecting meac300-fnade4 firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existing one.
Why this priority
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2025-27451?
meac300-fnade4 firmware: upgrade to newer than 0.16.0. Exact commands for each OS are on this page.
Is CVE-2025-27451 being exploited?
CVE-2025-27451 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2025-27451 affect?
CVE-2025-27451 affects meac300-fnade4 firmware. Severity is medium (CVSS 5.3). For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existing username. This allows an attacker to guess usernames until they find an existin
How urgent is CVE-2025-27451?
Priority 33/100. Remotely exploitable, no login, no user action
Related CVEs
- CVE-2025-27461 HIGH 7.6 MITIGATE During startup, the device automatically logs in the EPC2 Windows user without requesting a password.
- CVE-2025-27460 HIGH 7.6 MITIGATE The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker
- CVE-2025-27459 MEDIUM 4.4 MITIGATE The VNC application stores its passwords encrypted within the registry but uses DES for encryption
- CVE-2025-27458 MEDIUM 6.5 MITIGATE The VNC authentication mechanism bases on a challenge-response system where both server and client use the sam
- CVE-2025-27457 MEDIUM 6.5 MITIGATE All communication between the VNC server and client(s) is unencrypted