CVE-2025-2783

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.092 · 95 %ileexploit · PoCDEEUNLRUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV · 6 exploits · PoC

Likely / severe?

9.24% (95th) EPSS

CVSS 8.3 · high

Is it mine?

47 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2025-03-27remediate by 2025-04-17

required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-24

Google Chromium Mojo Sandbox Escape Vulnerability

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedCOMOS V10.4siemens_psirt
Update to V10.4.5 or later version
https://support.sw.siemens.com/product/222981661/
FixedCOMOS V10.5siemens_psirt
Update to V10.5.2 or later version
https://support.sw.siemens.com/product/222981661/
FixedCOMOS V10.4cisa_csaf_ot
Update to V10.4.5 or later version
https://support.sw.siemens.com/product/222981661/
FixedCOMOS V10.5cisa_csaf_ot
Update to V10.5.2 or later version
https://support.sw.siemens.com/product/222981661/

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.3highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · CISA US

v3.18.8highAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.3highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.3highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondaryexploitability 1.6 · impact 6

v3.18.3highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · Siemens ProductCERT DE

v3.18.3highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

v3.18.3highCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20USCWE-20USCWE-362US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

exploits (6)

Public proof-of-concept and weaponised exploit code.

affected products (47)

Products and version ranges known to be affected.

Jabra Jabra Direct <6.25.29101all versionscert_bundDE
Jabra Direct< 6.25.29101cert_bundDE
COMOS V10.4all versionscisa_csaf_otUS
COMOS V10.5all versionscisa_csaf_otUS
Siemens COMOS V10.4≤ vers:intdot/<10.4.5cisa_csaf_otUS
Siemens COMOS V10.5≤ vers:intdot/<10.5.2cisa_csaf_otUS
Google Chrome134.0.6998.177 → 134.0.6998.177enisa_euvdEU
Google Inc Google Chrome≤ 134.0.6998.178fstec_bduRU
Microsoft Corp Microsoft Edge≤ 134.0.3124.93fstec_bduRU
Palo Alto Networks Inc. Prisma Access Browser≤ 134.29.5.178fstec_bduRU
Google Chrome≤ vers:chrome/134.0.6998.177ncsc_nlNL
Google Chrome≤ vers:chrome/134.0.6998.178ncsc_nlNL
Siemens Building X - Security Manager Edge Controller (ACC-AP)≤ vers:unknown/*ncsc_nlNL
Siemens COMOS V10.4≤ vers:unknown/*ncsc_nlNL
Siemens COMOS V10.4.5≤ vers:unknown/*ncsc_nlNL
Siemens COMOS V10.5≤ vers:unknown/*ncsc_nlNL
Siemens COMOS V10.5.2≤ vers:unknown/*ncsc_nlNL
Siemens COMOS V10.6≤ vers:unknown/*ncsc_nlNL
Siemens Energy Services≤ vers:unknown/*ncsc_nlNL
Siemens Gridscale X Prepay≤ vers:unknown/*ncsc_nlNL

showing 20 of 47

advisories (6)

Vendor and ecosystem advisories describing this.

NCSC-2025-0098Kwetsbaarheid verholpen in Google ChromeNL2025-03-26csaf · ncsc_nlNL
Google heeft een kwetsbaarheid verholpen in Chrome.
NCSC-2025-0382Kwetsbaarheden verholpen in Siemens productenNL2025-12-09csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Building X, COMOS, Energy Services, Gridscale X, NX, RUGGEDCOM, SICAM, SIMATIC, SINEC, SINEMA, SIPLUS en Solid Edge.
SSA-212953SSA-212953: Multiple Vulnerabilities in COMOS2025-12-09csaf · siemens_psirtDE
COMOS is affected by multiple vulnerabilities that could allow an attacker to execute arbitrary code or cause denial of service condition, data infiltration or perform access control violations. Siemens has released new versions for the affected products and recommends to update to the latest versions.
WID-SEC-W-2025-0641Google Chrome/Microsoft Edge: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2025-03-25csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Google Chrome/Microsoft Edge ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
WID-SEC-W-2025-2456Jabra Direct: Schwachstelle ermöglicht Umgehen von SicherheitsvorkehrungenDeutsch2025-10-30csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Jabra Direct ausnutzen, um Sicherheitsvorkehrungen zu umgehen.
ICSA-26-043-03Siemens COMOS2025-12-09icsa · cisa_csaf_otUS
COMOS is affected by multiple vulnerabilities that could allow an attacker to execute arbitrary code or cause denial of service condition, data infiltration or perform access control violations. Siemens has released new versions for the affected products and recommends to update to the latest versions.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund cisa_csaf_ot ncsc_nl siemens_psirt NVD CVE.org MITRE

published 2025-03-26modified 2026-06-17

references (9)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan