Viessmann vulnerabilities
We track 4 vulnerabilities in Viessmann products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 23, 2025.
Latest Viessmann vulnerabilities
- 8.7 High severity
Vitogate 300: Client-Side Enforcement of Server-Side Security
The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By rem
- 8.5 High severity
Vitogate 300: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set
- 9.8 Critical severity
Vitogate 300 Firmware: Improper Neutralization of Special Elements used in a Command
In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method.
- 9.8 Critical severity
Vitogate 300: Use of Hard-coded Password
A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-bin/vitogate.cgi of the component Web Management Interface. The manipulation leads to use of hard-cod