CVE-2025-25264: Overly Permissive CORS Policy in WAGO Device Manager
An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-25264?
CVE-2025-25264 is considered a high severity vulnerability due to its potential to expose sensitive data.
How do I fix CVE-2025-25264?
To fix CVE-2025-25264, update the WAGO Device Manager to the latest version that addresses the overly permissive CORS policy.
Who is affected by CVE-2025-25264?
Users of WAGO Device Manager are affected by CVE-2025-25264 due to the vulnerability in its CORS configuration.
What can an attacker do with CVE-2025-25264?
An attacker exploiting CVE-2025-25264 can gain unauthorized access to responses, potentially leading to exposure of sensitive data.
Is CVE-2025-25264 a remote vulnerability?
Yes, CVE-2025-25264 is a remote vulnerability that allows unauthenticated attackers to exploit the CORS policy.