CVE-2025-9495

The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By removing specific UI elements, an attacker can reveal the hidden administration menu, giving them full control over the device.

CVSS

No CVSS.

References

Link	Resource
https://https://www.corporate.carrier.com/product-security/advisories-resources/

Configurations

No configuration.

History

11 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) La interfaz web de Vitogate 300 no logra aplicar una adecuada autenticación del lado del servidor y se basa en controles de autenticación basados en el frontend. Esto permite a un atacante simplemente modificar elementos HTML en las herramientas de desarrollador del navegador para eludir las restricciones de inicio de sesión. Al eliminar elementos específicos de la interfaz de usuario, un atacante puede revelar el menú de administración oculto, dándoles control total sobre el dispositivo.

Information

Published : 2025-09-23 02:15

Updated : 2026-10-11 20:10

NVD link : CVE-2025-9495

Mitre link : CVE-2025-9495

CVE.ORG link : CVE-2025-9495

JSON object : View

Products Affected

No product.

CWE

CWE-602

Client-Side Enforcement of Server-Side Security

{"id": "CVE-2025-9495", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9495", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-23T13:33:41.544746Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "productsecurity@carrier.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "productsecurity@carrier.com", "affectedData": [{"vendor": "Viessmann", "product": "Vitogate 300", "versions": [{"status": "affected", "version": "1", "lessThan": "3.0.0.0", "versionType": "date"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-23T02:15:47.563", "references": [{"url": "https://https://www.corporate.carrier.com/product-security/advisories-resources/", "source": "productsecurity@carrier.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "productsecurity@carrier.com", "description": [{"lang": "en", "value": "CWE-602"}]}], "descriptions": [{"lang": "en", "value": "The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser\u2019s developer tools to bypass login restrictions. By removing specific UI elements, an attacker can reveal the hidden administration menu, giving them full control over the device."}, {"lang": "es", "value": "La interfaz web de Vitogate 300 no logra aplicar una adecuada autenticaci\u00f3n del lado del servidor y se basa en controles de autenticaci\u00f3n basados en el frontend. Esto permite a un atacante simplemente modificar elementos HTML en las herramientas de desarrollador del navegador para eludir las restricciones de inicio de sesi\u00f3n. Al eliminar elementos espec\u00edficos de la interfaz de usuario, un atacante puede revelar el men\u00fa de administraci\u00f3n oculto, d\u00e1ndoles control total sobre el dispositivo."}], "lastModified": "2026-10-11T20:10:00.200", "sourceIdentifier": "productsecurity@carrier.com"}