VULNERABILITY INTELLIGENCE
CVE-2025-9495
CVSS score8.7 HIGH
EPSS probability0.24%
CISA KEVNot currently listed
Published2025-09-23
Last modified2026-10-11
CVSS vectorCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By removing specific UI elements, an attacker can reveal the hidden administration menu, giving them full control over the device.
Weakness classification
- CWE-602: Client-Side Enforcement of Server-Side Security