rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-41709 Command injection in power analyzer via Modbus-TCP and Modbus-RTU
An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write access on the affected device.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products: vendor: Janitza
product: UMG 96RM-E 24V(5222063)
default_status: unaffected
vendor: Janitza
product: UMG 96RM-E 230V(5222062)
default_status: unaffected
vendor: Weidmueller
product: ENERGY METER 750-230 (2540910000)
default_status: unaffected
vendor: Weidmueller
product: ENERGY METER 750-24 (2540900000)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Deutsche Telekom Security (DT Security)
Published: 2026-03-10T08:26:14.936Z
CVE-2025-41710 Use of Hard-coded Credentials in power analyzer
An unauthenticated remote attacker may use hardcodes credentials to get access to the previously activated FTP Server with limited read and write privileges.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Janitza
product: UMG 96RM-E 24V(5222063)
default_status: unaffected
vendor: Janitza
product: UMG 96RM-E 230V(5222062)
default_status: unaffected
vendor: Weidmueller
product: ENERGY METER 750-230 (2540910000)
default_status: unaffected
vendor: Weidmueller
product: ENERGY METER 750-24 (2540900000)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Deutsche Telekom Security (DT Security)
Published: 2026-03-10T08:26:30.909Z
CVE-2025-41711 Use of a Broken or Risky Cryptographic Algorithm for firmware images of power analyzer
An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access.
Problem types: cwe_id: CWE-327
description: CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Affected products: vendor: Janitza
product: UMG 96RM-E 24V(5222063)
default_status: unaffected
vendor: Janitza
product: UMG 96RM-E 230V(5222062)
default_status: unaffected
vendor: Weidmueller
product: ENERGY METER 750-230 (2540910000)
default_status: unaffected
vendor: Weidmueller
product: ENERGY METER 750-24 (2540900000)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Deutsche Telekom Security (DT Security)
Published: 2026-03-10T08:26:48.759Z
CVE-2025-41712 Incorrect Permission Assignment on power analyzer
An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive information on the device. This is a result of incorrect permission assignment for the web server.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Janitza
product: UMG 96RM-E 24V(5222063)
default_status: unaffected
vendor: Janitza
product: UMG 96RM-E 230V(5222062)
default_status: unaffected
vendor: Weidmueller
product: ENERGY METER 750-230 (2540910000)
default_status: unaffected
vendor: Weidmueller
product: ENERGY METER 750-24 (2540900000)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Deutsche Telekom Security (DT Security)
Published: 2026-03-10T08:27:10.120Z
CVE-2025-41714 Path Traversal via 'Upload-Key' in SmartEMS Upload Handling
The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an authenticated attacker can cause the server to create upload-related artifacts outside the intended storage location. In certain configurations this enables arbitrary file write and may be leveraged to achieve remote code execution.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Welotec
product: SmartEMS Web Application
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-09-10T06:48:10.130Z
CVE-2025-41715 Missing Authentication for Database Access in Web Application
The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: WAGO
product: Device Sphere
default_status: unaffected
vendor: WAGO
product: Solution Builder
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-09-24T09:04:22.835Z
CVE-2025-41716 Unauthenticated User Enumeration via Missing Authentication
The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding role due to missing authentication for critical function.
Problem types: cwe_id: CWE-306
description: CWE-306 Missing Authentication for Critical Function
Affected products: vendor: WAGO
product: Solution Builder
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2025-09-24T09:04:33.971Z
CVE-2025-41717 Config-Upload Code Injection
An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to improper control of code generation ('Code Injection’).
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Phoenix Contact
product: TC ROUTER 3002T-3G
default_status: unaffected
vendor: Phoenix Contact
product: TC ROUTER 2002T-3G
default_status: unaffected
vendor: Phoenix Contact
product: TC ROUTER 3002T-4G
default_status: unaffected
vendor: Phoenix Contact
product: TC ROUTER 3002T-4G GL
default_status: unaffected
vendor: Phoenix Contact
product: TC ROUTER 5004T-5G EU
default_status: unaffected
vendor: Phoenix Contact
product: TC ROUTER 3002T-4G VZW
default_status: unaffected
vendor: Phoenix Contact
product: TC ROUTER 3002T-4G ATT
default_status: unaffected
vendor: Phoenix Contact
product: TC ROUTER 2002T-4G
default_status: unaffected
vendor: Phoenix Contact
product: CLOUD CLIENT 1101T-TX/TX
default_status: unaffected
vendor: Phoenix Contact
product: TC CLOUD CLIENT 1002-4G ATT
default_status: unaffected
vendor: Phoenix Contact
product: TC CLOUD CLIENT 1002-TX/TX
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube
Published: 2026-01-13T07:48:19.811Z
CVE-2025-41718 Murrelektronik: Unprotected Transport of Credentials
A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and access the Web-UI.
Problem types: cwe_id: CWE-319
description: CWE-319 Cleartext Transmission of Sensitive Information
Affected products: vendor: Murrelektronik
product: Firmware Impact67 Pro 54630
default_status: unaffected
vendor: Murrelektronik
product: Firmware Impact67 Pro 54620
default_status: unaffected
vendor: Murrelektronik
product: Firmware Impact67 Pro 54631
default_status: unaffected
vendor: Murrelektronik
product: Firmware Impact67 Pro 54632
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Abhishek Pandey from Payatu Security Consulting Pvt. Ltd.
Published: 2025-10-14T08:25:52.136Z
CVE-2025-41719 Sauter: Improper Validation of user-controlled data
A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters which leads to deletion of all previously configured users and the creation of the default Administrator with a known default password.
Problem types: cwe_id: CWE-1286
description: CWE-1286:Improper Validation of Syntactic Correctness of Input
Affected products: vendor: Sauter
product: modulo 6 devices modu680-AS
default_status: unaffected
vendor: Sauter
product: modulo 6 devices modu660-AS
default_status: unaffected
vendor: Sauter
product: modulo 6 devices modu612-LC
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 modu 5 modu524
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 modu 5 modu525
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 ecos 5 ecos504/505
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Damian Pfammatter, Daniel Hulliger from Cyber-Defence Campus armasuisse
Published: 2025-10-22T06:48:30.796Z
CVE-2025-41720 Sauter: Arbitrary File Upload
A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified.
Problem types: cwe_id: CWE-646
description: CWE-646:Reliance on File Name or Extension of Externally-Supplied File
Affected products: vendor: Sauter
product: modulo 6 devices modu680-AS
default_status: unaffected
vendor: Sauter
product: modulo 6 devices modu660-AS
default_status: unaffected
vendor: Sauter
product: modulo 6 devices modu612-LC
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 modu 5 modu524
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 modu 5 modu525
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 ecos 5 ecos504/505
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Damian Pfammatter, Daniel Hulliger from Cyber-Defence Campus armasuisse
Published: 2025-10-22T06:52:03.019Z
CVE-2025-41721 Sauter: Command Injection
A high privileged remote attacker can influence the parameters passed to the openssl command due to improper neutralization of special elements when adding a password protected self-signed certificate.
Problem types: cwe_id: CWE-77
description: CWE-77:Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Sauter
product: modulo 6 devices modu680-AS
default_status: unaffected
vendor: Sauter
product: modulo 6 devices modu660-AS
default_status: unaffected
vendor: Sauter
product: modulo 6 devices modu612-LC
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 modu 5 modu524
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 modu 5 modu525
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 ecos 5 ecos504/505
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Damian Pfammatter, Daniel Hulliger from Cyber-Defence Campus armasuisse S+T
Published: 2025-10-22T06:55:22.860Z
CVE-2025-41722 Sauter: Hard-coded Authentication Credentials
The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices.
Problem types: cwe_id: CWE-798
description: CWE-798 Use of Hard-coded Credentials
Affected products: vendor: Sauter
product: modulo 6 devices modu680-AS
default_status: unaffected
vendor: Sauter
product: modulo 6 devices modu660-AS
default_status: unaffected
vendor: Sauter
product: modulo 6 devices modu612-LC
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 modu 5 modu524
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 modu 5 modu525
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 ecos 5 ecos504/505
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Damian Pfammatter, Daniel Hulliger from Cyber-Defence Campus armasuisse S+T
Published: 2025-10-22T06:58:31.679Z
CVE-2025-41723 Sauter: Directory Traversal in importFile SOAP Method
The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations.
Problem types: cwe_id: CWE-35
description: CWE-35:Path Traversal: '.../...//'
Affected products: vendor: Sauter
product: modulo 6 devices modu680-AS
default_status: unaffected
vendor: Sauter
product: modulo 6 devices modu660-AS
default_status: unaffected
vendor: Sauter
product: modulo 6 devices modu612-LC
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 modu 5 modu524
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 modu 5 modu525
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 ecos 5 ecos504/505
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Damian Pfammatter, Daniel Hulliger from Cyber-Defence Campus armasuisse S+T
Published: 2025-10-22T07:01:09.768Z
CVE-2025-41724 Sauter: Crash via Incomplete SOAP Request
An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests. The wscserver process will not be restarted by a watchdog and a device reboot is necessary to make it work again.
Problem types: cwe_id: CWE-239
description: CWE-239:Failure to Handle Incomplete Element
Affected products: vendor: Sauter
product: modulo 6 devices modu680-AS
default_status: unaffected
vendor: Sauter
product: modulo 6 devices modu660-AS
default_status: unaffected
vendor: Sauter
product: modulo 6 devices modu612-LC
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 modu 5 modu524
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 modu 5 modu525
default_status: unaffected
vendor: Sauter
product: EY-modulo 5 ecos 5 ecos504/505
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Damian Pfammatter, Daniel Hulliger from Cyber-Defence Campus armasuisse S+T
Published: 2025-10-22T07:03:50.109Z
CVE-2025-41726 Beckhoff: Arbitrary code execution within privileged processes
A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API and can cause integer overflows which then may lead to arbitrary code execution within privileged processes.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: Beckhoff Automation
product: Beckhoff.Device.Manager.XAR
default_status: unaffected
vendor: Beckhoff Automation
product: MDP software package for TwinCAT/BSD
default_status: unaffected
vendor: Beckhoff Automation
product: MDP for Beckhoff RT Linux(R)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Diego Giubertoni from Nozomi Networks
Published: 2026-01-27T11:35:37.391Z
CVE-2025-41727 Beckhoff:  Performing privileged operations and gaining administrator access
A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain administrator access.
Problem types: cwe_id: CWE-420
description: CWE-420 Unprotected Alternate Channel
Affected products: vendor: Beckhoff Automation
product: Beckhoff.Device.Manager.XAR
default_status: unaffected
vendor: Beckhoff Automation
product: MDP software package for TwinCAT/BSD
default_status: unaffected
vendor: Beckhoff Automation
product: MDP for Beckhoff RT Linux(R)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Diego Giubertoni from Nozomi Networks
Published: 2026-01-27T11:36:54.619Z
CVE-2025-41728 Beckhoff: Information leak via Beckhoff Device Manager
A low privileged remote attacker may be able to disclose confidential information from the memory of a privileged process by sending specially crafted calls to the Device Manager web service that cause an out-of-bounds read operation under certain circumstances due to ASLR and thereby potentially copy confidential information into a response.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: Beckhoff Automation
product: Beckhoff.Device.Manager.XAR
default_status: unaffected
vendor: Beckhoff Automation
product: MDP software package for TwinCAT/BSD
default_status: unaffected
vendor: Beckhoff Automation
product: MDP for Beckhoff RT Linux(R)
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Diego Giubertoni from Nozomi Networks
Published: 2026-01-27T11:37:55.689Z
CVE-2025-41729 DoS via Modbus Read Command
An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service.
Problem types: cwe_id: CWE-1287
description: CWE-1287 Improper Validation of Specified Type of Input
Affected products: vendor: Janitza
product: UMG 96-PA
default_status: unaffected
vendor: Janitza
product: UMG 96-PA-MID+
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Milence - Commercial Vehicle Charging Europe B.V.
Published: 2025-11-24T11:27:15.058Z
CVE-2025-41730 Stack-based buffer overflow via unsafe sscanf in check_account()
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
Problem types: cwe_id: CWE-121
description: CWE-121 Stack-based Buffer Overflow
Affected products: vendor: WAGO
product: Indsutrial-Managed-Switches
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Daniel Hulliger from The Cyber-Defence Campus of armasuisse S+T
Published: 2025-12-10T11:04:13.112Z
CVE-2025-41731 Jumo: Insufficient entropy in PRNG may lead to root access
A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the debug interface is still enabled.
Problem types: cwe_id: CWE-338
description: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Affected products: vendor: Jumo
product: variTRON300
default_status: unaffected
vendor: Jumo
product: variTRON500
default_status: unaffected
vendor: Jumo
product: variTRON500 touch
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2025-11-10T07:44:40.644Z