CVE-2025-41645

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-669

Affected software

No affected versions have been published.

Timeline

Published
May 13, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-416469.8An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. ThiCVE-2025-416475.5A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation thCVE-2025-416489.8An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and chanCVE-2025-416497.5An unauthenticated remote attacker can exploit insufficient input validation to write data beyond the bounds of a buffer, potentially leadinCVE-2025-416507.5An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations aCVE-2025-416519.8Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potenCVE-2025-416529.8The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker couldCVE-2025-416537.5An unauthenticated remote attacker can exploit a denial-of-service vulnerability in the device's web server functionality by sending a speciCVE-2025-416548.2An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can triCVE-2025-416557.5An unauthenticated remote attacker can access a URL which causes the device to reboot.CVE-2025-4165610.0An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for thCVE-2025-416574.3Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible by
CVE-2025-41645: High severity, CVSS 8.6 | Vulnix