{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12055", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "state": "PUBLISHED", "assignerShortName": "SEC-VLab", "dateReserved": "2025-10-22T06:45:51.500Z", "datePublished": "2025-10-27T06:36:36.526Z", "dateUpdated": "2025-11-03T17:32:04.323Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "MIP 2", "vendor": "MPDV Mikrolab GmbH", "versions": [{"status": "affected", "version": "<Maintenance Pack 36 with Servicepack 8, release week 36/2025"}]}, {"defaultStatus": "unaffected", "product": "FEDRA 2", "vendor": "MPDV Mikrolab GmbH", "versions": [{"status": "affected", "version": "<Maintenance Pack 36 with Servicepack 8, release week 36/2025"}]}, {"defaultStatus": "unaffected", "product": "HYDRA X", "vendor": "MPDV Mikrolab GmbH", "versions": [{"status": "affected", "version": "<Maintenance Pack 36 with Servicepack 8, release week 36/2025"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Lukas Donaubauer, SEC Consult Vulnerability Lab"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36&nbsp;with Servicepack 8 (week 36/2025), which allows an attacker to read arbitrary files from the Windows operating system. The \"Filename\" parameter of the public $SCHEMAS$ ressource is vulnerable and can be exploited easily.<br><br>"}], "value": "HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36\u00a0with Servicepack 8 (week 36/2025), which allows an attacker to read arbitrary files from the Windows operating system. The \"Filename\" parameter of the public $SCHEMAS$ ressource is vulnerable and can be exploited easily."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2025-10-27T06:36:36.526Z"}, "references": [{"url": "https://r.sec-consult.com/mpdv"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "The vulnerability is fixed in the following version:<br><ul><li>Maintenance Pack of week 36/2025 for MIP2 / FEDRA2 / HYDRA X with Servicepack 8</li></ul>Customers can download the patch from the vendor's support portal.<br>"}], "value": "The vulnerability is fixed in the following version:\n * Maintenance Pack of week 36/2025 for MIP2 / FEDRA2 / HYDRA X with Servicepack 8\n\n\nCustomers can download the patch from the vendor's support portal."}], "source": {"discovery": "EXTERNAL"}, "title": "Unauthenticated Local File Disclosure in MPDV Mikrolab MIP 2 / FEDRA 2 / HYDRA X Manufacturing Execution System", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-10-27T18:33:02.661553Z", "id": "CVE-2025-12055", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T18:33:13.891Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2025/Oct/28"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:32:04.323Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2025/Oct/28"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:32:04.323Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-12055", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-27T18:33:02.661553Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-27T18:32:55.301Z"}}], "cna": {"title": "Unauthenticated Local File Disclosure in MPDV Mikrolab MIP 2 / FEDRA 2 / HYDRA X Manufacturing Execution System", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Lukas Donaubauer, SEC Consult Vulnerability Lab"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "affected": [{"vendor": "MPDV Mikrolab GmbH", "product": "MIP 2", "versions": [{"status": "affected", "version": "<Maintenance Pack 36 with Servicepack 8, release week 36/2025"}], "defaultStatus": "unaffected"}, {"vendor": "MPDV Mikrolab GmbH", "product": "FEDRA 2", "versions": [{"status": "affected", "version": "<Maintenance Pack 36 with Servicepack 8, release week 36/2025"}], "defaultStatus": "unaffected"}, {"vendor": "MPDV Mikrolab GmbH", "product": "HYDRA X", "versions": [{"status": "affected", "version": "<Maintenance Pack 36 with Servicepack 8, release week 36/2025"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "The vulnerability is fixed in the following version:\n * Maintenance Pack of week 36/2025 for MIP2 / FEDRA2 / HYDRA X with Servicepack 8\n\n\nCustomers can download the patch from the vendor's support portal.", "supportingMedia": [{"type": "text/html", "value": "The vulnerability is fixed in the following version:<br><ul><li>Maintenance Pack of week 36/2025 for MIP2 / FEDRA2 / HYDRA X with Servicepack 8</li></ul>Customers can download the patch from the vendor's support portal.<br>", "base64": false}]}], "references": [{"url": "https://r.sec-consult.com/mpdv"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36\u00a0with Servicepack 8 (week 36/2025), which allows an attacker to read arbitrary files from the Windows operating system. The \"Filename\" parameter of the public $SCHEMAS$ ressource is vulnerable and can be exploited easily.", "supportingMedia": [{"type": "text/html", "value": "HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36&nbsp;with Servicepack 8 (week 36/2025), which allows an attacker to read arbitrary files from the Windows operating system. The \"Filename\" parameter of the public $SCHEMAS$ ressource is vulnerable and can be exploited easily.<br><br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "shortName": "SEC-VLab", "dateUpdated": "2025-10-27T06:36:36.526Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12055", "state": "PUBLISHED", "dateUpdated": "2025-11-03T17:32:04.323Z", "dateReserved": "2025-10-22T06:45:51.500Z", "assignerOrgId": "551230f0-3615-47bd-b7cc-93e92e730bbf", "datePublished": "2025-10-27T06:36:36.526Z", "assignerShortName": "SEC-VLab"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36\u00a0with Servicepack 8 (week 36/2025), which allows an attacker to read arbitrary files from the Windows operating system. The \"Filename\" parameter of the public $SCHEMAS$ ressource is vulnerable and can be exploited easily."}], "id": "CVE-2025-12055", "lastModified": "2025-11-03T18:15:48.737", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2025-10-27T07:15:37.727", "references": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "url": "https://r.sec-consult.com/mpdv"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2025/Oct/28"}], "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "type": "Secondary"}]}

{}