Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-41685 State: PUBLISHED Published: 2025-08-19T08:10:05.103Z Last Updated: 2025-08-19T13:19:34.567Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: SMA Products: ennexos.sunnyportal.com Problem Types: CWE-359 Description: A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-050
CVE ID: CVE-2025-41686 State: PUBLISHED Published: 2025-08-12T07:37:01.370Z Last Updated: 2025-08-12T18:03:02.285Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Phoenix Contact Products: DaUM Problem Types: CWE-306 Description: A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-063
CVE ID: CVE-2025-41687 State: PUBLISHED Published: 2025-07-23T08:23:52.447Z Last Updated: 2025-07-23T14:03:59.533Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Weidmueller Products: IE-SR-2TX-WL, IE-SR-2TX-WL-4G-EU, IE-SR-2TX-WL-4G-US-V Problem Types: CWE-121 Description: An unauthenticated remote attacker may use a stack based buffer overflow in the u-link Management API to gain full access on the affected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-052
CVE ID: CVE-2025-41688 State: PUBLISHED Published: 2025-07-31T10:02:49.655Z Last Updated: 2025-07-31T13:17:23.918Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: MB connect line, Helmholz Products: mbNET HW1, mbNET/mbNET.rokey, REX 300, REX 200/250 Problem Types: CWE-653 Description: A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-065 - https://certvde.com/de/advisories/VDE-2025-069
CVE ID: CVE-2025-41689 State: PUBLISHED Published: 2025-08-19T08:07:01.652Z Last Updated: 2025-08-25T09:23:13.175Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Wiesemann & Theis Products: Motherbox 3 Problem Types: CWE-306 Description: An unauthenticated remote attacker can get access without password protection to the affected device. This enables the unprotected read-only access to the stored measurement data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-067
CVE ID: CVE-2025-41690 State: PUBLISHED Published: 2025-09-02T08:12:13.946Z Last Updated: 2025-09-02T13:48:59.186Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Endress+Hauser Products: Promag 10 with HART, Promag 10 with IO-Link, Promag 10 with Modbus, Promass 10 with HART, Promass 10 with IO-Link, Promass 10 with Modbus Problem Types: CWE-532 Description: A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive configuration se
the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive configuration settings and the ability to modify device parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-068
CVE ID: CVE-2025-41691 State: PUBLISHED Published: 2025-08-04T08:04:34.981Z Last Updated: 2025-08-04T16:32:30.773Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: CODESYS Products: Control RTE (SL), Control RTE (for Beckhoff CX) SL, Control Win (SL), HMI (SL), Control for BeagleBone SL, Control for emPC-A/iMX6 SL, Control for IOT2000 SL, Control for Linux ARM SL, Control for Linux SL, Control for PFC100 SL, Control for PFC200 SL, Control for PLCnext SL, Control for Raspberry Pi SL, Control for WAGO Touch Panels 600 SL, Virtual Control SL Problem Types: CWE-476 Description: An unauthenticated remote attacker may trigger a NULL pointer dereference in the affecte
lem Types: CWE-476 Description: An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-070
CVE ID: CVE-2025-41698 State: PUBLISHED Published: 2025-08-05T08:06:08.584Z Last Updated: 2025-08-05T13:21:13.819Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Draeger Products: Draeger ICMHelper Problem Types: CWE-862 Description: A low privileged local attacker can interact with the affected service although user-interaction should not be allowed. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-028
CVE ID: CVE-2025-41699 State: PUBLISHED Published: 2025-10-14T08:35:05.215Z Last Updated: 2025-10-15T06:36:45.974Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Phoenix Contact Products: CHARX SEC-3150, CHARX SEC-3100, CHARX SEC-3050, CHARX SEC-3000 Problem Types: CWE-94 Description: An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resulting in a total loss of confidentiality, availability and integrity due to improper control of generation of code ('Code Injection'). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phoenixcontact
tion of code ('Code Injection'). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-074.json
CVE ID: CVE-2025-41701 State: PUBLISHED Published: 2025-09-09T08:57:28.132Z Last Updated: 2025-09-09T19:32:19.683Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Beckhoff Products: TE1000 | TwinCAT 3 Enineering Problem Types: CWE-502 Description: An unauthenticated attacker can trick a local user into executing arbitrary commands by opening a deliberately manipulated project file with an affected engineering tool. These arbitrary commands are executed in the user context. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-075
CVE ID: CVE-2025-41702 State: PUBLISHED Published: 2025-08-26T06:10:57.464Z Last Updated: 2025-08-26T19:39:00.393Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Welotec Products: EG400Mk2-D11001-000101, EG400Mk2-D11101-000101, EG503W, EG503L, EG503W_4GB, EG503L_4GB, EG503L-G, EG500Mk2-A11101-000101, EG500Mk2-A11001-000101, EG500Mk2-B11101-000101, EG500Mk2-B11001-000101, EG500Mk2-C11101-000101, EG500Mk2-C11001-000101, EG500Mk2-A12011-000101, EG500Mk2-A11001-000201, EG500Mk2-A21101-000101, EG602W, EG602L, EG603W Mk2, EG603L Mk2, EG802W, EG804W, EG802W_i7_512GB_DinRail, EG802W_i7_512GB_w/o DinRail, EG804W Pro Problem Types: CWE-321 Description: The JWT secr
G804W, EG802W_i7_512GB_DinRail, EG802W_i7_512GB_w/o DinRail, EG804W Pro Problem Types: CWE-321 Description: The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-076
CVE ID: CVE-2025-41703 State: PUBLISHED Published: 2025-10-14T08:05:23.395Z Last Updated: 2025-11-03T17:44:45.524Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Phoenix Contact Products: QUINT4-UPS/24DC/24DC/5/EIP, QUINT4-UPS/24DC/24DC/10/EIP, QUINT4-UPS/24DC/24DC/20/EIP, QUINT4-UPS/24DC/24DC/40/EIP Problem Types: CWE-306 Description: An unauthenticated remote attacker can cause a Denial of Service by turning off the output of the UPS via Modbus command. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://certvde.com/de/advisories/VDE-2025-072
CVE ID: CVE-2025-41704 State: PUBLISHED Published: 2025-10-14T08:05:34.171Z Last Updated: 2025-11-03T17:44:46.483Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Phoenix Contact Products: QUINT4-UPS/24DC/24DC/5/EIP, QUINT4-UPS/24DC/24DC/10/EIP, QUINT4-UPS/24DC/24DC/20/EIP, QUINT4-UPS/24DC/24DC/40/EIP Problem Types: CWE-770 Description: An unauthanticated remote attacker can perform a DoS of the Modbus service by sending a specific function and sub-function code without affecting the core functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://certvde.com/de/advisories/VDE-2025-072
CVE ID: CVE-2025-41705 State: PUBLISHED Published: 2025-10-14T08:05:43.031Z Last Updated: 2025-11-03T17:44:47.442Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Phoenix Contact Products: QUINT4-UPS/24DC/24DC/5/EIP, QUINT4-UPS/24DC/24DC/10/EIP, QUINT4-UPS/24DC/24DC/20/EIP, QUINT4-UPS/24DC/24DC/40/EIP Problem Types: CWE-523 Description: An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://certvde.com/de/advisories/VDE-2025-072
CVE ID: CVE-2025-41706 State: PUBLISHED Published: 2025-10-14T08:05:56.266Z Last Updated: 2025-11-03T17:44:48.379Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Phoenix Contact Products: QUINT4-UPS/24DC/24DC/5/EIP, QUINT4-UPS/24DC/24DC/10/EIP, QUINT4-UPS/24DC/24DC/20/EIP, QUINT4-UPS/24DC/24DC/40/EIP Problem Types: CWE-120 Description: The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cert
re functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://certvde.com/de/advisories/VDE-2025-072
CVE ID: CVE-2025-41707 State: PUBLISHED Published: 2025-10-14T08:06:11.424Z Last Updated: 2025-11-03T17:44:49.327Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Phoenix Contact Products: QUINT4-UPS/24DC/24DC/5/EIP, QUINT4-UPS/24DC/24DC/10/EIP, QUINT4-UPS/24DC/24DC/20/EIP, QUINT4-UPS/24DC/24DC/40/EIP Problem Types: CWE-120 Description: The websocket handler is vulnerable to a denial of service condition. An unauthenticated remote attacker can send a crafted websocket message to trigger the issue without affecting the core functionality. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://certvde.com/de/advisorie
ditional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://certvde.com/de/advisories/VDE-2025-072
CVE ID: CVE-2025-41708 State: PUBLISHED Published: 2025-09-08T06:38:50.386Z Last Updated: 2025-09-08T18:04:06.675Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Bender Products: CC612, CC613, ICC15xx, ICC16xx, ICC13xx Problem Types: CWE-319 Description: Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-084
CVE ID: CVE-2025-41713 State: PUBLISHED Published: 2025-09-15T08:00:50.241Z Last Updated: 2025-09-15T15:23:17.088Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: WAGO Products: CC100 0751-9301, CC100 0751-9301 HW rev. &lt;082100, CC100 0751-9301/K000-0005, CC100 0751-9301/K000-0005 HW rev. &lt;082100, CC100 0751-9401, CC100 0751-9401 HW rev. &lt;052500, CC100 0751-9402, CC100 0751-9402/0000-0001, CC100 0751-9402/0000-0001 HW rev. &lt;052800, CC100 0751-9402 HW rev. &lt;032800, CC100 0751-9403, CC100 0751-9403 HW rev. &lt;022800, Edge Controller 0752-8303/8000-0002, Edge Controller 0752-8303/8000-0002 HW rev. 32500, TP600 0762-4101, TP600 0762-4101 HW rev. &
oller 0752-8303/8000-0002, Edge Controller 0752-8303/8000-0002 HW rev. 32500, TP600 0762-4101, TP600 0762-4101 HW rev. &lt;072500, TP600 0762-4102, TP600 0762-4102 HW rev. &lt;072500, TP600 0762-4104, TP600 0762-4104 HW rev. &lt;062500, TP600 0762-4201/8000-0001, TP600 0762-4201/8000-0001 HW rev. &lt;072500, TP600 0762-4201/8000-0002, TP600 0762-4201/8000-0002 HW rev. &lt;072500, TP600 0762-4301/8000-0002, TP600 0762-4301/8000-0002 HW rev. &lt;072500, TP600 0762-4302/8000-0002, TP600 0762-4302/8000-0002 HW rev. &lt;072500, TP600 0762-4303/8000-0002, TP600 0762-4303/8000-0002 HW rev. &lt;062500, TP600 0762-4304/8000-0002, TP600 0762-4304/8000-0002 HW rev. &lt;062500, TP600 0762-4305/8000-0002
2 HW rev. &lt;062500, TP600 0762-4304/8000-0002, TP600 0762-4304/8000-0002 HW rev. &lt;062500, TP600 0762-4305/8000-0002, TP600 0762-4305/8000-0002 HW rev. &lt;052500, TP600 0762-4306/8000-0001, TP600 0762-4306/8000-0001 HW rev. &lt;042500, TP600 0762-4306/8000-0002, TP600 0762-4306/8000-0002 HW rev. &lt;042500, TP600 0762-5201/8000-0001, TP600 0762-5201/8000-0001 HW rev. &lt;062500, TP600 0762-5203/8000-0001, TP600 0762-5203/8000-0001 HW rev. &lt;062500, TP600 0762-5204/8000-0001, TP600 0762-5204/8000-0001 HW rev. &lt;052500, TP600 0762-5205/8000-0001, TP600 0762-5205/8000-0001 HW rev. &lt;032500, TP600 0762-5206/8000-0001, TP600 0762-5206/8000-0001 HW rev. &lt;042500 Problem Types: CWE-118
-0001 HW rev. &lt;032500, TP600 0762-5206/8000-0001, TP600 0762-5206/8000-0001 HW rev. &lt;042500 Problem Types: CWE-1188 Description: During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating in an undefined state until a CPU-induced reset allows proper configuration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/en/advisories/VDE-2025-083 - https://wago.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-083.json
CVE ID: CVE-2025-41714 State: PUBLISHED Published: 2025-09-10T06:48:10.130Z Last Updated: 2025-09-10T19:27:45.979Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Welotec Products: SmartEMS Web Application Problem Types: CWE-22 Description: The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an authenticated attacker can cause the server to create upload-related artifacts outside the intended storage location. In certain configurations this enables arbitrary file write and may be leveraged to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://c
e leveraged to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-085
CVE ID: CVE-2025-41715 State: PUBLISHED Published: 2025-09-24T09:04:22.835Z Last Updated: 2025-09-24T13:07:30.391Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WAGO Products: Device Sphere, Solution Builder Problem Types: CWE-306 Description: The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-087
CVE ID: CVE-2025-41716 State: PUBLISHED Published: 2025-09-24T09:04:33.971Z Last Updated: 2025-09-24T13:03:53.265Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: WAGO Products: Solution Builder Problem Types: CWE-306 Description: The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-087
CVE ID: CVE-2025-41718 State: PUBLISHED Published: 2025-10-14T08:25:52.136Z Last Updated: 2025-10-14T18:42:14.852Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Murrelektronik Products: Firmware Impact67 Pro 54630, Firmware Impact67 Pro 54620, Firmware Impact67 Pro 54631, Firmware Impact67 Pro 54632 Problem Types: CWE-319 Description: A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and access the Web-UI. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://murrelektronik.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-091.jso
ADP Vulnrichment: References: - https://murrelektronik.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-091.json
CVE ID: CVE-2025-41719 State: PUBLISHED Published: 2025-10-22T06:48:30.796Z Last Updated: 2025-10-22T15:47:29.413Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Sauter Products: modulo 6 devices modu680-AS, modulo 6 devices modu660-AS, modulo 6 devices modu612-LC, EY-modulo 5 modu 5 modu524, EY-modulo 5 modu 5 modu525, EY-modulo 5 ecos 5 ecos504/505 Problem Types: CWE-1286 Description: A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters which leads to deletion of all previously configured users and the creation of the default Administrator with a known default password. Additi
n of all previously configured users and the creation of the default Administrator with a known default password. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-060.json
CVE ID: CVE-2025-41720 State: PUBLISHED Published: 2025-10-22T06:52:03.019Z Last Updated: 2025-10-22T15:48:07.323Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Sauter Products: modulo 6 devices modu680-AS, modulo 6 devices modu660-AS, modulo 6 devices modu612-LC, EY-modulo 5 modu 5 modu524, EY-modulo 5 modu 5 modu525, EY-modulo 5 ecos 5 ecos504/505 Problem Types: CWE-646 Description: A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sauter.csaf-tp.certvde.com/.wel
on is verified. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-060.json
CVE ID: CVE-2025-41721 State: PUBLISHED Published: 2025-10-22T06:55:22.860Z Last Updated: 2025-10-22T13:31:30.683Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: Sauter Products: modulo 6 devices modu680-AS, modulo 6 devices modu660-AS, modulo 6 devices modu612-LC, EY-modulo 5 modu 5 modu524, EY-modulo 5 modu 5 modu525, EY-modulo 5 ecos 5 ecos504/505 Problem Types: CWE-77 Description: A high privileged remote attacker can influence the parameters passed to the openssl command due to improper neutralization of special elements when adding a password protected self-signed certificate. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://saute
ssword protected self-signed certificate. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-060.json
CVE ID: CVE-2025-41722 State: PUBLISHED Published: 2025-10-22T06:58:31.679Z Last Updated: 2025-10-22T13:30:10.827Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Sauter Products: modulo 6 devices modu680-AS, modulo 6 devices modu660-AS, modulo 6 devices modu612-LC, EY-modulo 5 modu 5 modu524, EY-modulo 5 modu 5 modu525, EY-modulo 5 ecos 5 ecos504/505 Problem Types: CWE-798 Description: The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sauter.csaf-t
Software of the affected devices. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-060.json
CVE ID: CVE-2025-41723 State: PUBLISHED Published: 2025-10-22T07:01:09.768Z Last Updated: 2025-10-22T13:28:51.323Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sauter Products: modulo 6 devices modu680-AS, modulo 6 devices modu660-AS, modulo 6 devices modu612-LC, EY-modulo 5 modu 5 modu524, EY-modulo 5 modu 5 modu525, EY-modulo 5 ecos 5 ecos504/505 Problem Types: CWE-35 Description: The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sauter.csaf-tp.certvde.c
o arbitrary locations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-060.json
CVE ID: CVE-2025-41724 State: PUBLISHED Published: 2025-10-22T07:03:50.109Z Last Updated: 2025-10-22T15:48:40.087Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Sauter Products: modulo 6 devices modu680-AS, modulo 6 devices modu660-AS, modulo 6 devices modu612-LC, EY-modulo 5 modu 5 modu524, EY-modulo 5 modu 5 modu525, EY-modulo 5 ecos 5 ecos504/505 Problem Types: CWE-239 Description: An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests. The wscserver process will not be restarted by a watchdog and a device reboot is necessary to make it work again. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
a device reboot is necessary to make it work again. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-060.json
CVE ID: CVE-2025-41729 State: PUBLISHED Published: 2025-11-24T11:27:15.058Z Last Updated: 2025-11-24T13:16:00.535Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Janitza Products: UMG 96-PA, UMG 96-PA-MID+ Problem Types: CWE-1287 Description: An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://certvde.com/de/advisories/VDE-2025-094
CVE ID: CVE-2025-41731 State: PUBLISHED Published: 2025-11-10T07:44:40.644Z Last Updated: 2025-11-10T15:20:07.843Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Jumo Products: variTRON300, variTRON500, variTRON500 touch Problem Types: CWE-338 Description: A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the debug interface is still enabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jumo.