CVE-2025-25264 — Overly Permissive CORS Policy in WAGO Device Manager
An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to …
Published: 2025-06-16 · CVSS: 6.5 · CVSS 3.1
An unauthenticated remote attacker can trick an admin to visit a website containing malicious java script code. The current overly permissive CORS policy allows the attacker to obtain any files from the file system.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7