Management Summary
The Manufacturing Execution System HYDRA X, MIP 2 as well as FEDRA 2 developed by MPDV Mikrolab was found to be vulnerable to a local file disclosure vulnerability. An unauthenticated attacker was able to read all the local files of the underlying operating system in the context of the current hard drive where the software was installed.
Vendor description
"You monitor, control and optimize your production continuously with HYDRA X. You can therefore keep an eye on all resources at all times and design your production processes to be as efficient as possible. Digitization in production is unstoppable! Companies who want to produce efficiently need HYDRA X."
Source: https://www.mpdv.com/en/products/mes-hydra-x
Business recommendation
The vendor provides a patch in their support portal which should be installed immediately.
SEC Consult highly recommends performing a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues.
Vulnerability overview/description
1) Unauthenticated Local File Disclosure (CVE-2025-12055)
HYDRA X, MIP2 and FEDRA 2 suffer from an unauthenticated local file disclosure vulnerability which allows an attacker to read arbitrary files from the Windows operating system (HYDRA X is designed to work on Windows). The “Filename” parameter of the public $SCHEMAS$ ressource is vulnerable and can be exploited easily.
Proof of concept
1) Unauthenticated Local File Disclosure (CVE-2025-12055)
The following proof of concept shows the HTTP request that was used to read local files of the server's operating system. The vulnerability can be triggered as soon as a vulnerable version of the software is in use. Authorization and authentication are not needed.
HTTP Request:
GET /hx/resources/public/$SCHEMAS$?Filename=c%3a%5cwindows%5cwin.ini HTTP/1.1Vulnerable / tested versions
The following versions have been tested and found to be vulnerable:
- 10.14.STD
- According to the vendor MIP 2 / FEDRA 2 / HYDRA X with Servicepack 8, up until the maintenance pack of week 35/2025 are vulnerable