meac300-fnade4 firmware vulnerabilities and fixes

Recent CVEs affecting meac300-fnade4 firmware, with upgrade or downgrade steps. 19 tracked.

Also searched as: meac300 fnade4 firmware, meac300-fnade4firmware.

meac300-fnade4 firmware has 19 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 13. Most recent: 2025-07-03. Highest priority: CVE-2025-1708 (score 45/100).

• CVE-2025-27461 HIGH 7.6 MITIGATE During startup, the device automatically logs in the EPC2 Windows user without requesting a password.
• CVE-2025-27460 HIGH 7.6 MITIGATE The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker
• CVE-2025-27459 MEDIUM 4.4 MITIGATE The VNC application stores its passwords encrypted within the registry but uses DES for encryption
• CVE-2025-27458 MEDIUM 6.5 MITIGATE The VNC authentication mechanism bases on a challenge-response system where both server and client use the sam
• CVE-2025-27457 MEDIUM 6.5 MITIGATE All communication between the VNC server and client(s) is unencrypted
• CVE-2025-27456 HIGH 7.5 MITIGATE The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authenticat
• CVE-2025-27455 MEDIUM 4.3 UPGRADE The web application is vulnerable to clickjacking attacks
• CVE-2025-27454 MEDIUM 4.3 UPGRADE The application is vulnerable to cross-site request forgery
• CVE-2025-27453 MEDIUM 5.3 UPGRADE The HttpOnly flag is set to false on the PHPSESSION cookie
• CVE-2025-27452 MEDIUM 5.3 UPGRADE The configuration of the Apache httpd webserver which serves the MEAC300-FNADE4 web application, is partly ins
• CVE-2025-27451 MEDIUM 5.3 UPGRADE For failed login attempts, the application returns different error messages depending on whether the login fai
• CVE-2025-27450 MEDIUM 6.5 UPGRADE The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4
• CVE-2025-27449 HIGH 7.5 UPGRADE The MEAC300-FNADE4 does not implement sufficient measures to prevent multiple failed authentication attempts w
• CVE-2025-27448 MEDIUM 6.8 UPGRADE The web application is susceptible to cross-site-scripting attacks
• CVE-2025-27447 HIGH 7.4 UPGRADE The web application is susceptible to cross-site-scripting attacks
• CVE-2025-1711 MEDIUM 4.3 UPGRADE Multiple services of the DUT as well as different scopes of the same service reuse the same credentials.
• CVE-2025-1710 HIGH 7.5 UPGRADE The maxView Storage Manager does not implement sufficient measures to prevent multiple failed authentication a
• CVE-2025-1709 MEDIUM 6.5 UPGRADE Several credentials for the local PostgreSQL database are stored in plain text (partially base64 encoded).
• CVE-2025-1708 HIGH 8.6 UPGRADE The application is vulnerable to SQL injection attacks

FAQ

How do I fix meac300-fnade4 firmware vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is meac300-fnade4 firmware being exploited right now?

None of the tracked meac300-fnade4 firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which meac300-fnade4 firmware CVE should I patch first?

CVE-2025-1708 currently ranks highest (45/100): The application is vulnerable to SQL injection attacks.

RSS feed for meac300-fnade4 firmware · ← Back to latest CVEs