---
id: CVE-2025-9495
title: >-
  The Vitogate 300 web interface fails to enforce proper server-side
  authentication and relies on frontend-based authentication controls
summary: >-
  The Vitogate 300 web interface fails to enforce proper server-side
  authentication and relies on frontend-based authentication controls. This
  allows an attacker to simply modify HTML elements in the browser’s developer
  tools to bypass log…
severity: none
cwe:
  - CWE-602
published: '2025-09-23'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T20:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-9495'
references:
  - url: >-
      https://https://www.corporate.carrier.com/product-security/advisories-resources/
    label: productsecurity@carrier.com
tags:
  - nvd
epss: 0.00241
epssPercentile: 0.1402
ingestedAt: '2026-10-12T14:50:33.974Z'
---

## Overview

The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By removing specific UI elements, an attacker can reveal the hidden administration menu, giving them full control over the device.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.