CVE-2025-9495
Viessmann Vitogate 300 Authentication Bypass
- State
- Published
- Severity
- 8.7 High
- Published
- Sep 23, 2025
- Updated
- Sep 23, 2025
- Reserved
- Aug 26, 2025
Description
The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By removing specific UI elements, an attacker can reveal the hidden administration menu, giving them full control over the device.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | Carrier |
Weaknesses
- CWE-602 Client-Side Enforcement of Server-Side Security
Affected Products
| Product | Versions |
|---|---|
Vitogate 300Viessmann |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.