rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-41660 CODESYS Control Boot Application Replacement Enables Code Execution
A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized code execution.
Problem types: cwe_id: CWE-669
description: CWE-669 Incorrect Resource Transfer Between Spheres
Affected products: vendor: CODESYS
product: CODESYS Control RTE (SL)
default_status: unaffected
vendor: CODESYS
product: CODESYS Control RTE (for Beckhoff CX) SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control Win (SL)
default_status: unaffected
vendor: CODESYS
product: CODESYS HMI (SL)
default_status: unaffected
vendor: CODESYS
product: CODESYS Runtime Toolkit
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for BeagleBone SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for emPC-A/iMX6 SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for IOT2000 SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for Linux ARM SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for Linux SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for PFC100 SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for PFC200 SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for PLCnext SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for Raspberry Pi SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Control for WAGO Touch Panels 600 SL
default_status: unaffected
vendor: CODESYS
product: CODESYS Virtual Control SL
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Luca Borzacchiello from Nozomi Networks
Published: 2026-03-24T07:41:43.004Z
CVE-2025-41661 Weidmueller: Security routers IE-SR-2TX are affected by CSRF
An unauthenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of Cross-Site Request Forgery (CSRF) protection.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Weidmueller
product: IE-SR-2TX-WL
default_status: unaffected
vendor: Weidmueller
product: IE-SR-2TX-WL-4G-EU
default_status: unaffected
vendor: Weidmueller
product: IE-SR-2TX-WL-4G-US-V
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: ONEKEY Research Labs
Published: 2025-06-11T08:13:27.237Z
CVE-2025-41663 Weidmueller: Security routers IE-SR-2TX are affected by Command Injection
For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary commands in responses returned by WWH servers, which are then executed with elevated privileges. To get into such a position, clients would need to use insecure proxy configurations.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Weidmueller
product: IE-SR-2TX-WL
default_status: unaffected
vendor: Weidmueller
product: IE-SR-2TX-WL-4G-EU
default_status: unaffected
vendor: Weidmueller
product: IE-SR-2TX-WL-4G-US-V
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: ONEKEY Research Labs
Published: 2025-06-11T08:15:55.357Z
CVE-2025-41664 Improper Permission Handling Enables Unauthorized Access to Firmware and Certificates
A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper permission handling during the runtime of services (e.g., FTP/SFTP). This access could allow the attacker to escalate privileges and modify firmware.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: WAGO
product: Coupler 0750-0362
default_status: unaffected
vendor: WAGO
product: Coupler 0750-0362/0000-0001
default_status: unaffected
vendor: WAGO
product: Coupler 0750-0362/0040-0000
default_status: unaffected
vendor: WAGO
product: Coupler 0750-0362/K013-1080
default_status: unaffected
vendor: WAGO
product: Coupler 0750-0362/K019-7576
default_status: unaffected
vendor: WAGO
product: Coupler 0750-0363
default_status: unaffected
vendor: WAGO
product: Coupler 0750-0363/0040-0000
default_status: unaffected
vendor: WAGO
product: Coupler 0750-0364/0040-0010
default_status: unaffected
vendor: WAGO
product: Coupler 0750-0365/0040-0010
default_status: unaffected
vendor: WAGO
product: Coupler 0750-0366
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-09-08T06:39:19.566Z
CVE-2025-41665 Phoenix Contact: DoS of the PLC due to incorrect default permissions possible
An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of a config file.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect Default Permissions
Affected products: vendor: PHOENIX CONTACT
product: AXC F 1152
default_status: unaffected
vendor: PHOENIX CONTACT
product: AXC F 2152
default_status: unaffected
vendor: PHOENIX CONTACT
product: AXC F 3152
default_status: unaffected
vendor: PHOENIX CONTACT
product: BPC 9102S
default_status: unaffected
vendor: PHOENIX CONTACT
product: RFC 4072S
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Nozomi
Published: 2025-07-08T07:03:26.147Z
CVE-2025-41666 Phoenix Contact: File access due to the replacement of a critical file used by the watchdog
A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized.
Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: PHOENIX CONTACT
product: AXC F 1152
default_status: unaffected
vendor: PHOENIX CONTACT
product: AXC F 2152
default_status: unaffected
vendor: PHOENIX CONTACT
product: AXC F 3152
default_status: unaffected
vendor: PHOENIX CONTACT
product: BPC 9102S
default_status: unaffected
vendor: PHOENIX CONTACT
product: RFC 4072S
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Nozomi
Published: 2025-07-08T07:03:38.410Z
CVE-2025-41667 Phoenix Contact: File access due to the replacement of a critical file used by the arp-preinit script
A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device.
Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: PHOENIX CONTACT
product: AXC F 1152
default_status: unaffected
vendor: PHOENIX CONTACT
product: AXC F 2152
default_status: unaffected
vendor: PHOENIX CONTACT
product: AXC F 3152
default_status: unaffected
vendor: PHOENIX CONTACT
product: BPC 9102S
default_status: unaffected
vendor: PHOENIX CONTACT
product: RFC 4072S
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Nozomi
Published: 2025-07-08T07:03:50.761Z
CVE-2025-41668 Phoenix Contact: File access due to the replacement of a critical file used by the service security-profile
A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device.
Problem types: cwe_id: CWE-59
description: CWE-59 Improper Link Resolution Before File Access ('Link Following')
Affected products: vendor: PHOENIX CONTACT
product: AXC F 1152
default_status: unaffected
vendor: PHOENIX CONTACT
product: AXC F 2152
default_status: unaffected
vendor: PHOENIX CONTACT
product: AXC F 3152
default_status: unaffected
vendor: PHOENIX CONTACT
product: BPC 9102S
default_status: unaffected
vendor: PHOENIX CONTACT
product: RFC 4072S
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Nozomi
Published: 2025-07-08T07:04:22.922Z
CVE-2025-41669 Insufficient Verification of Data Authenticity
The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implementing any data verification mechanism, leading to the capability for an Engineer user to reach arbitrary code execution with root privileges on the PLC device. A successful exploitation may allow to install a manipulated APP package, potentially impacting integrity and availability of the PLCnext Control.
Problem types: cwe_id: CWE-347
description: CWE-347 Improper Verification of Cryptographic Signature
Affected products: vendor: Phoenix Contact
product: AXC F 1152
default_status: unaffected
vendor: Phoenix Contact
product: AXC F 1252
default_status: unaffected
vendor: Phoenix Contact
product: AXC F 2000 EA
default_status: unaffected
vendor: Phoenix Contact
product: AXC F 2152
default_status: unaffected
vendor: Phoenix Contact
product: AXC F 3152
default_status: unaffected
vendor: Phoenix Contact
product: BPC 9102S
default_status: unaffected
vendor: Phoenix Contact
product: EPC 1522
default_status: unaffected
vendor: Phoenix Contact
product: RFC 4072R
default_status: unaffected
vendor: Phoenix Contact
product: RFC 4072S
default_status: unaffected
vendor: Phoenix Contact
product: VL3 UPC 2440 EDGE
default_status: unaffected
vendor: Phoenix Contact
product: VPLCNEXT CONTROL 1000
default_status: unaffected
vendor: Phoenix Contact
product: VPLCNEXT CONTROL 2000
default_status: unaffected
vendor: Phoenix Contact
product: VPLCNEXT CONTROL 3000
default_status: unaffected
vendor: Phoenix Contact
product: VPLCNEXT CONTROL 500
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Diego Giubertoni from Nozomi
Published: 2026-05-27T07:18:28.236Z
CVE-2025-41670 Untrusted Search Path
A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related files located in user-writable areas of the filesystem. The affected service processes data from locations that are not sufficiently protected against modification by low-privileged users. As the service runs with elevated privileges, successful exploitation may result in a local privilege escalation.
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: Phoenix Contact
product: AXC F 1152
default_status: unaffected
vendor: Phoenix Contact
product: AXC F 1252
default_status: unaffected
vendor: Phoenix Contact
product: AXC F 2000 EA
default_status: unaffected
vendor: Phoenix Contact
product: AXC F 2152
default_status: unaffected
vendor: Phoenix Contact
product: AXC F 3152
default_status: unaffected
vendor: Phoenix Contact
product: BPC 9102S
default_status: unaffected
vendor: Phoenix Contact
product: EPC 1522
default_status: unaffected
vendor: Phoenix Contact
product: RFC 4072R
default_status: unaffected
vendor: Phoenix Contact
product: RFC 4072S
default_status: unaffected
vendor: Phoenix Contact
product: VL3 UPC 2440 EDGE
default_status: unaffected
vendor: Phoenix Contact
product: VPLCNEXT CONTROL 1000
default_status: unaffected
vendor: Phoenix Contact
product: VPLCNEXT CONTROL 2000
default_status: unaffected
vendor: Phoenix Contact
product: VPLCNEXT CONTROL 3000
default_status: unaffected
vendor: Phoenix Contact
product: VPLCNEXT CONTROL 500
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Diego Giubertoni from Nozomi
Published: 2026-05-27T07:17:43.775Z
CVE-2025-41672 WAGO: Vulnerability in WAGO Device Sphere
A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool and all connected devices.
Problem types: cwe_id: CWE-1188
description: CWE-1188
Affected products: vendor: WAGO
product: Wago Device Sphere
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2025-07-07T06:17:18.988Z
CVE-2025-41673 Remote Command Injection in send_sms Action Due to Improper Input Neutralization
A high privileged remote attacker can execute arbitrary system commands via POST requests in the send_sms action due to improper neutralization of special elements used in an OS command.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: MB connect line
product: mbNET.mini
default_status: unaffected
vendor: Helmholz
product: REX 100
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: F. Bruckmoser, M. Eder, J. Heigl, M. Heudorn, G. Hofmarcher, M. Kadlec, M. Pristauz-Telsnigg, S. Resch, P. Schweinzer, M. Gschiel from St. Poelten UAS
Published: 2025-07-21T09:29:32.129Z
CVE-2025-41674 Remote Command Injection in diagnostic Action Due to Improper Input Neutralization
A high privileged remote attacker can execute arbitrary system commands via POST requests in the diagnostic action due to improper neutralization of special elements used in an OS command.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: MB connect line
product: mbNET.mini
default_status: unaffected
vendor: Helmholz
product: REX 100
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: F. Bruckmoser, M. Eder, J. Heigl, M. Heudorn, G. Hofmarcher, M. Kadlec, M. Pristauz-Telsnigg, S. Resch, P. Schweinzer, M. Gschiel from St. Poelten UAS
Published: 2025-07-21T09:29:43.181Z
CVE-2025-41675 Remote Command Injection via GET in Cloud Server Communication Script Due to Improper Input Neutralization
A high privileged remote attacker can execute arbitrary system commands via GET requests in the cloud server communication script due to improper neutralization of special elements used in an OS command.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: MB connect line
product: mbNET.mini
default_status: unaffected
vendor: Helmholz
product: REX 100
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: F. Bruckmoser, M. Eder, J. Heigl, M. Heudorn, G. Hofmarcher, M. Kadlec, M. Pristauz-Telsnigg, S. Resch, P. Schweinzer, M. Gschiel from St. Poelten UAS
Published: 2025-07-21T09:29:57.024Z
CVE-2025-41676 Resource Exhaustion via POST Requests to send-sms Action
A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-sms action in fast succession.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: MB connect line
product: mbNET.mini
default_status: unaffected
vendor: Helmholz
product: REX 100
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F. Bruckmoser, M. Eder, J. Heigl, M. Heudorn, G. Hofmarcher, M. Kadlec, M. Pristauz-Telsnigg, S. Resch, P. Schweinzer, M. Gschiel from St. Poelten UAS
Published: 2025-07-21T09:30:07.473Z
CVE-2025-41677 Resource Exhaustion via POST Requests to send-mail Action
A high privileged remote attacker can exhaust critical system resources by sending specifically crafted POST requests to the send-mail action in fast succession.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: MB connect line
product: mbNET.mini
default_status: unaffected
vendor: Helmholz
product: REX 100
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F. Bruckmoser, M. Eder, J. Heigl, M. Heudorn, G. Hofmarcher, M. Kadlec, M. Pristauz-Telsnigg, S. Resch, P. Schweinzer, M. Gschiel from St. Poelten UAS
Published: 2025-07-21T09:30:28.614Z
CVE-2025-41678 SQL Injection via POST Requests Allowing Configuration Database Manipulation
A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statement.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: MB connect line
product: mbNET.mini
default_status: unaffected
vendor: Helmholz
product: REX 100
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: F. Bruckmoser, M. Eder, J. Heigl, M. Heudorn, G. Hofmarcher, M. Kadlec, M. Pristauz-Telsnigg, S. Resch, P. Schweinzer, M. Gschiel from St. Poelten UAS
Published: 2025-07-21T09:30:44.484Z
CVE-2025-41679 Unauthenticated Buffer Overflow in Conftool Service Leading to Denial of Service
An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: MB connect line
product: mbNET.mini
default_status: unaffected
vendor: Helmholz
product: REX 100
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: F. Bruckmoser, M. Eder, J. Heigl, M. Heudorn, G. Hofmarcher, M. Kadlec, M. Pristauz-Telsnigg, S. Resch, P. Schweinzer, M. Gschiel from St. Poelten UAS
Published: 2025-07-21T09:31:04.713Z
CVE-2025-41681 Persistent Cross-Site Scripting via POST Requests Due to Improper Neutralization of Input
A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MB connect line
product: mbNET.mini
default_status: unaffected
vendor: Helmholz
product: REX 100
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: F. Bruckmoser, M. Eder, J. Heigl, M. Heudorn, G. Hofmarcher, M. Kadlec, M. Pristauz-Telsnigg, S. Resch, P. Schweinzer, M. Gschiel from St. Poelten UAS
Published: 2025-07-21T09:31:25.796Z