6.5
Medium
CVE-2025-25264 An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code
Description
An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| CC100 0751-9x01 0.0 | 0.0.0 → latest | No fix stated |
| PFC100 G1 0750-810x/xxxx-xxxx 0.0 | 0.0.0 → latest | No fix stated |
| PFC100 G2 0750-811x-xxxx-xxxx 0.0 | 0.0.0 → latest | No fix stated |
| PFC200 G1 750-820x-xxx-xxx 0.0 | 0.0.0 → latest | No fix stated |
| PFC200 G2 750-821x-xxx-xxx 0.0 | 0.0.0 → latest | No fix stated |
| TP600 0762-420x/8000-000x 0.0 | 0.0.0 → latest | No fix stated |
| TP600 0762-430x/8000-000x 0.0 | 0.0.0 → latest | No fix stated |
| TP600 0762-520x/8000-000x 0.0 | 0.0.0 → latest | No fix stated |
| TP600 0762-530x/8000-000x 0.0 | 0.0.0 → latest | No fix stated |
Show the 3 other branches Hide the 3 other branches
| Product | Affected versions | Fixed in |
|---|---|---|
| TP600 0762-620x/8000-000x 0.0 | 0.0.0 → latest | No fix stated |
| TP600 0762-630x/8000-000x 0.0 | 0.0.0 → latest | No fix stated |
| Edge Controller 0752-8303/8000-0002 0.0 | 0.0.0 → latest | No fix stated |
Other CVEs of CC100 0751-9x01
The 12 CVEs of CC100 0751-9x01 →
CVE-2025-25265
A web application for configuring the controller is accessible at a specific path
4.9
Medium
CVE-2025-0101
A low privileged user can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time…
6.5
Medium
CVE-2024-12650
An attacker with low privileges can manipulate the requested memory size, causing the application to use an invalid…
5.4
Medium
CVE-2024-41974
A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for…
7.1
High