Vitogate 300 vulnerabilities

3 known vulnerabilities in Vitogate 300 from Viessmann. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  Vitogate 300: Client-Side Enforcement of Server-Side Security

  CVE-2025-9495Sep 23, 2025Viessmann

  The Vitogate 300 web interface fails to enforce proper server-side authentication and relies on frontend-based authentication controls. This allows an attacker to simply modify HTML elements in the browser’s developer tools to bypass login restrictions. By rem

• 8.5 High severity

  Vitogate 300: Improper Neutralization of Special Elements used in an OS Command

  CVE-2025-9494Sep 23, 2025Viessmann

  An OS command injection vulnerability has been discovered in the Vitogate 300, which can be exploited by malicious users to compromise affected installations. Specifically, the `/cgi-bin/vitogate.cgi` endpoint is affected, when the `form` JSON parameter is set

• 9.8 Critical severity

  Vitogate 300: Use of Hard-coded Password

  CVE-2023-5222Sep 27, 2023ViessmannEPSS 80.4%

  A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. This vulnerability affects the function isValidUser of the file /cgi-bin/vitogate.cgi of the component Web Management Interface. The manipulation leads to use of hard-cod