Riskcovery

CVE-2025-12055

Unauthenticated Local File Disclosure in MPDV Mikrolab MIP 2 / FEDRA 2 / HYDRA X Manufacturing Execution System

State
Published
Severity
7.5 High
Published
Oct 27, 2025
Updated
Nov 3, 2025
Reserved
Oct 22, 2025

Read the record on cve.org

Description

HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 with Servicepack 8 (week 36/2025), which allows an attacker to read arbitrary files from the Windows operating system. The "Filename" parameter of the public $SCHEMAS$ ressource is vulnerable and can be exploited easily.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCISA-ADP

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

ProductVersions
MIP 2MPDV Mikrolab GmbH
  • <Maintenance Pack 36 with Servicepack 8, release week 36/2025Affected
FEDRA 2MPDV Mikrolab GmbH
  • <Maintenance Pack 36 with Servicepack 8, release week 36/2025Affected
HYDRA XMPDV Mikrolab GmbH
  • <Maintenance Pack 36 with Servicepack 8, release week 36/2025Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.