Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-41645 State: PUBLISHED Published: 2025-05-13T08:47:33.564Z Last Updated: 2025-05-13T13:11:10.091Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N) Vendors: SMA Products: www.sunnyportal.com Problem Types: CWE-669 Description: An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2025-010
CVE ID: CVE-2025-41646 State: PUBLISHED Published: 2025-06-06T14:42:31.249Z Last Updated: 2025-06-06T15:06:11.989Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Kunbus Products: Revolution Pi webstatus Problem Types: CWE-704 Description: An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full compromise of the device Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.kunbus.com/en/productsecurity/Kunbus-2025-0000003 - https://psirt.kunbus.com/.well-known/csaf/white/2025/kunbus-2025-0000003.json
CVE ID: CVE-2025-41647 State: PUBLISHED Published: 2025-06-25T09:40:37.325Z Last Updated: 2025-06-25T12:41:00.771Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Lenze Products: PLC Designer V4 Problem Types: CWE-312 Description: A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the password being displayed in plain text under special conditions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-043/
CVE ID: CVE-2025-41648 State: PUBLISHED Published: 2025-07-01T08:10:24.679Z Last Updated: 2025-07-02T13:24:37.115Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Pilz Products: IndustrialPI 4 with IndustrialPI webstatus Problem Types: CWE-704 Description: An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-039
CVE ID: CVE-2025-41649 State: PUBLISHED Published: 2025-05-27T08:37:26.201Z Last Updated: 2025-05-27T13:57:42.958Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Weidmueller Products: IE-SW-VL05M-5TX, IE-SW-VL05MT-5TX, IE-SW-VL08MT-8TX, IE-SW-VL08MT-5TX-1SC-2SCS, IE-SW-VL08MT-6TX-2SC, IE-SW-VL08MT-6TX-2ST, IE-SW-VL08MT-6TX-2SCS, IE-SW-PL10M-3GT-7TX, IE-SW-PL10MT-3GT-7TX, IE-SW-PL16M-16TX, IE-SW-PL16MT-16TX, IE-SW-PL18M-2GC-16TX, IE-SW-PL18MT-2GC-16TX Problem Types: CWE-787 Description: An unauthenticated remote attacker can exploit insufficient input validation to write data beyond the bounds of a buffer, potentially leading to a denial-of-service condition f
ent input validation to write data beyond the bounds of a buffer, potentially leading to a denial-of-service condition for the devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-044/
CVE ID: CVE-2025-41650 State: PUBLISHED Published: 2025-05-27T08:37:44.635Z Last Updated: 2025-05-27T13:39:51.332Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Weidmueller Products: IE-SW-VL05M-5TX, IE-SW-VL05MT-5TX, IE-SW-VL08MT-8TX, IE-SW-VL08MT-5TX-1SC-2SCS, IE-SW-VL08MT-6TX-2SC, IE-SW-VL08MT-6TX-2ST, IE-SW-VL08MT-6TX-2SCS, IE-SW-PL10M-3GT-7TX, IE-SW-PL10MT-3GT-7TX, IE-SW-PL16M-16TX, IE-SW-PL16MT-16TX, IE-SW-PL18M-2GC-16TX, IE-SW-PL18MT-2GC-16TX Problem Types: CWE-1287 Description: An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations and potentially cause a denial-of-se
lidation in cmd services of the devices, allowing them to disrupt system operations and potentially cause a denial-of-service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-044/
CVE ID: CVE-2025-41651 State: PUBLISHED Published: 2025-05-27T08:38:03.213Z Last Updated: 2025-05-27T13:26:59.857Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Weidmueller Products: IE-SW-VL05M-5TX, IE-SW-VL05MT-5TX, IE-SW-VL08MT-8TX, IE-SW-VL08MT-5TX-1SC-2SCS, IE-SW-VL08MT-6TX-2SC, IE-SW-VL08MT-6TX-2ST, IE-SW-VL08MT-6TX-2SCS, IE-SW-PL10M-3GT-7TX, IE-SW-PL10MT-3GT-7TX, IE-SW-PL16M-16TX, IE-SW-PL16MT-16TX, IE-SW-PL18M-2GC-16TX, IE-SW-PL18MT-2GC-16TX Problem Types: CWE-306 Description: Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upl
of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upload or download of configuration files and leading to full system compromise. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-044/
CVE ID: CVE-2025-41652 State: PUBLISHED Published: 2025-05-27T08:38:12.340Z Last Updated: 2025-08-22T10:36:13.148Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Weidmueller Products: IE-SW-VL05M-5TX, IE-SW-VL05MT-5TX, IE-SW-VL08MT-8TX, IE-SW-VL08MT-5TX-1SC-2SCS, IE-SW-VL08MT-6TX-2SC, IE-SW-VL08MT-6TX-2ST, IE-SW-VL08MT-6TX-2SCS, IE-SW-PL10M-3GT-7TX, IE-SW-PL10MT-3GT-7TX, IE-SW-PL16M-16TX, IE-SW-PL16MT-16TX, IE-SW-PL18M-2GC-16TX, IE-SW-PL18MT-2GC-16TX Problem Types: CWE-328 Description: The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker could exploit this weakness by perfor
ss due to flaws in the authorization mechanism. An unauthenticated remote attacker could exploit this weakness by performing brute-force attacks to guess valid credentials or by using MD5 collision techniques to forge authentication hashes, potentially compromising the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-044/
CVE ID: CVE-2025-41653 State: PUBLISHED Published: 2025-05-27T08:38:29.005Z Last Updated: 2025-05-27T13:12:39.961Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Weidmueller Products: IE-SW-VL05M-5TX, IE-SW-VL05MT-5TX, IE-SW-VL08MT-8TX, IE-SW-VL08MT-5TX-1SC-2SCS, IE-SW-VL08MT-6TX-2SC, IE-SW-VL08MT-6TX-2ST, IE-SW-VL08MT-6TX-2SCS, IE-SW-PL10M-3GT-7TX, IE-SW-PL10MT-3GT-7TX, IE-SW-PL16M-16TX, IE-SW-PL16MT-16TX, IE-SW-PL18M-2GC-16TX, IE-SW-PL18MT-2GC-16TX Problem Types: CWE-410 Description: An unauthenticated remote attacker can exploit a denial-of-service vulnerability in the device's web server functionality by sending a specially crafted HTTP request with a mal
of-service vulnerability in the device's web server functionality by sending a specially crafted HTTP request with a malicious header, potentially causing the server to crash or become unresponsive. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-044/
CVE ID: CVE-2025-41654 State: PUBLISHED Published: 2025-05-26T08:21:54.033Z Last Updated: 2025-08-22T09:18:26.543Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: Pepperl+Fuchs Products: Profinet Gateway FB8122A.1.EL, Profinet Gateway LB8122A.1.EL Problem Types: CWE-306 Description: An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can trigger a reboot by the watchdog. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2025-011
CVE ID: CVE-2025-41655 State: PUBLISHED Published: 2025-05-26T08:22:13.883Z Last Updated: 2025-05-27T14:25:34.580Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Pepperl+Fuchs Products: Profinet Gateway FB8122A.1.EL, Profinet Gateway LB8122A.1.EL Problem Types: CWE-306 Description: An unauthenticated remote attacker can access a URL which causes the device to reboot. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-011
CVE ID: CVE-2025-41656 State: PUBLISHED Published: 2025-07-01T08:10:06.208Z Last Updated: 2025-07-01T14:32:08.516Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Pilz Products: IndustrialPI 4 with Firmware Bullseye Problem Types: CWE-306 Description: An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by default. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-045
CVE ID: CVE-2025-41657 State: PUBLISHED Published: 2025-06-10T10:46:30.034Z Last Updated: 2025-06-10T14:25:52.710Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Auma Products: AC1.2, PROFOX Problem Types: CWE-207 Description: Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible by an unauthenticated adjacent attacker. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-047
CVE ID: CVE-2025-41658 State: PUBLISHED Published: 2025-08-04T08:03:26.511Z Last Updated: 2025-08-04T11:52:37.949Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: CODESYS Products: Runtime Toolkit, Control for BeagleBone SL, Control for emPC-A/iMX6 SL, Control for IOT2000 SL, Control for Linux ARM SL, Control for Linux SL, Control for PFC100 SL, Control for PFC200 SL, Control for PLCnext SL, Control for Raspberry Pi SL, Control for WAGO Touch Panels 600 SL, Virtual Control SL Problem Types: CWE-276 Description: CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions. Add
products may expose sensitive files to local low-privileged operating system users due to default file permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-049
CVE ID: CVE-2025-41659 State: PUBLISHED Published: 2025-08-04T08:04:04.597Z Last Updated: 2025-08-04T16:35:32.484Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: CODESYS Products: Control RTE (SL), Control RTE (for Beckhoff CX) SL, Control Win (SL), HMI (SL), Runtime Toolkit, Control for BeagleBone SL, Control for emPC-A/iMX6 SL, Control for IOT2000 SL, Control for Linux ARM SL, Control for Linux SL, Control for PFC100 SL, Control for PFC200 SL, Control for PLCnext SL, Control for Raspberry Pi SL, Control for WAGO Touch Panels 600 SL, Virtual Control SL Problem Types: CWE-732 Description: A low-privileged attacker can remotely access the PKI folder of the COD
l Control SL Problem Types: CWE-732 Description: A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allows sensitive data to be extracted or to accept certificates as trusted. Although all services remain available, only unencrypted communication is possible if the certificates are deleted. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-051
CVE ID: CVE-2025-41661 State: PUBLISHED Published: 2025-06-11T08:13:27.237Z Last Updated: 2025-07-24T14:33:16.906Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Weidmueller Products: IE-SR-2TX-WL, IE-SR-2TX-WL-4G-EU, IE-SR-2TX-WL-4G-US-V Problem Types: CWE-352 Description: An unauthenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of Cross-Site Request Forgery (CSRF) protection. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-052
CVE ID: CVE-2025-41662 State: REJECTED Published: 2025-06-11T08:08:17.544Z Last Updated: 2025-07-23T07:53:17.747Z Description: No description available.
CVE ID: CVE-2025-41663 State: PUBLISHED Published: 2025-06-11T08:15:55.357Z Last Updated: 2025-07-24T14:32:41.460Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Weidmueller Products: IE-SR-2TX-WL, IE-SR-2TX-WL-4G-EU, IE-SR-2TX-WL-4G-US-V Problem Types: CWE-78 Description: For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary commands in responses returned by WWH servers, which are then executed with elevated privileges. To get into such a position, clients would need to use insecure proxy configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advi
ecure proxy configurations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-052
CVE ID: CVE-2025-41664 State: PUBLISHED Published: 2025-09-08T06:39:19.566Z Last Updated: 2025-09-08T16:03:08.365Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WAGO Products: Coupler 0750-0362, Coupler 0750-0362/0000-0001, Coupler 0750-0362/0040-0000, Coupler 0750-0362/K013-1080, Coupler 0750-0362/K019-7576, Coupler 0750-0363, Coupler 0750-0363/0040-0000, Coupler 0750-0364/0040-0010, Coupler 0750-0365/0040-0010, Coupler 0750-0366 Problem Types: CWE-732 Description: A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper permission handling during the runtime of services (e.g.,
resources, such as firmware and certificates, due to improper permission handling during the runtime of services (e.g., FTP/SFTP). This access could allow the attacker to escalate privileges and modify firmware. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-048
CVE ID: CVE-2025-41665 State: PUBLISHED Published: 2025-07-08T07:03:26.147Z Last Updated: 2025-07-08T14:10:19.960Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: PHOENIX CONTACT Products: AXC F 1152, AXC F 2152, AXC F 3152, BPC 9102S, RFC 4072S Problem Types: CWE-276 Description: An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-054
CVE ID: CVE-2025-41666 State: PUBLISHED Published: 2025-07-08T07:03:38.410Z Last Updated: 2025-07-08T14:28:36.584Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: AXC F 1152, AXC F 2152, AXC F 3152, BPC 9102S, RFC 4072S Problem Types: CWE-59 Description: A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-054
CVE ID: CVE-2025-41667 State: PUBLISHED Published: 2025-07-08T07:03:50.761Z Last Updated: 2025-07-08T14:28:29.391Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: AXC F 1152, AXC F 2152, AXC F 3152, BPC 9102S, RFC 4072S Problem Types: CWE-59 Description: A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-054
CVE ID: CVE-2025-41668 State: PUBLISHED Published: 2025-07-08T07:04:22.922Z Last Updated: 2025-07-08T14:28:20.367Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: AXC F 1152, AXC F 2152, AXC F 3152, BPC 9102S, RFC 4072S Problem Types: CWE-59 Description: A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-054
CVE ID: CVE-2025-41672 State: PUBLISHED Published: 2025-07-07T06:17:18.988Z Last Updated: 2025-07-07T16:34:52.794Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: WAGO Products: Wago Device Sphere Problem Types: CWE-1188 Description: A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2025-057 - https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-057.json
CVE ID: CVE-2025-41673 State: PUBLISHED Published: 2025-07-21T09:29:32.129Z Last Updated: 2025-11-03T19:58:57.413Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: MB connect line, Helmholz Products: mbNET.mini, REX 100 Problem Types: CWE-78 Description: A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elements used in an OS command. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://certvde.com/de/advisories/VDE-2025-058
CVE ID: CVE-2025-41674 State: PUBLISHED Published: 2025-07-21T09:29:43.181Z Last Updated: 2025-11-03T19:58:58.776Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: MB connect line, Helmholz Products: mbNET.mini, REX 100 Problem Types: CWE-78 Description: A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://certvde.com/de/advisories/VDE-2025-058
CVE ID: CVE-2025-41675 State: PUBLISHED Published: 2025-07-21T09:29:57.024Z Last Updated: 2025-11-03T19:59:00.344Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: MB connect line, Helmholz Products: mbNET.mini, REX 100 Problem Types: CWE-78 Description: A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://certvde.com/de/advisories/VDE-2025-058
CVE ID: CVE-2025-41676 State: PUBLISHED Published: 2025-07-21T09:30:07.473Z Last Updated: 2025-11-03T19:59:01.738Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: MB connect line, Helmholz Products: mbNET.mini, REX 100 Problem Types: CWE-400 Description: A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://certvde.com/de/advisories/VDE-2025-058
CVE ID: CVE-2025-41677 State: PUBLISHED Published: 2025-07-21T09:30:28.614Z Last Updated: 2025-11-03T19:59:03.144Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: MB connect line, Helmholz Products: mbNET.mini, REX 100 Problem Types: CWE-400 Description: A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://certvde.com/de/advisories/VDE-2025-058
CVE ID: CVE-2025-41678 State: PUBLISHED Published: 2025-07-21T09:30:44.484Z Last Updated: 2025-11-03T19:59:04.559Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: MB connect line, Helmholz Products: mbNET.mini, REX 100 Problem Types: CWE-89 Description: A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statement. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://certvde.com/de/advisories/VDE-2025-058
CVE ID: CVE-2025-41679 State: PUBLISHED Published: 2025-07-21T09:31:04.713Z Last Updated: 2025-11-03T19:59:05.914Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: MB connect line, Helmholz Products: mbNET.mini, REX 100 Problem Types: CWE-787 Description: An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://certvde.com/de/advisories/VDE-2025-058
CVE ID: CVE-2025-41681 State: PUBLISHED Published: 2025-07-21T09:31:25.796Z Last Updated: 2025-11-03T19:59:07.270Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: MB connect line, Helmholz Products: mbNET.mini, REX 100 Problem Types: CWE-79 Description: A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://certvde.com/de/advisories/VDE-2025-058
CVE ID: CVE-2025-41682 State: PUBLISHED Published: 2025-09-08T06:38:31.579Z Last Updated: 2025-09-08T18:04:43.038Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Bender Products: CC612, CC613, ICC16xx, ICC13xx Problem Types: CWE-522 Description: An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-061
CVE ID: CVE-2025-41683 State: PUBLISHED Published: 2025-07-23T08:22:48.380Z Last Updated: 2025-07-23T14:08:32.342Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Weidmueller Products: IE-SR-2TX-WL, IE-SR-2TX-WL-4G-EU, IE-SR-2TX-WL-4G-US-V Problem Types: CWE-78 Description: An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint event_mail_test). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-052
CVE ID: CVE-2025-41684 State: PUBLISHED Published: 2025-07-23T08:23:28.046Z Last Updated: 2025-07-23T14:04:20.683Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Weidmueller Products: IE-SR-2TX-WL, IE-SR-2TX-WL-4G-EU, IE-SR-2TX-WL-4G-US-V Problem Types: CWE-78 Description: An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint tls_iotgen_setting). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-052