CVE-2025-41649

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker can exploit insufficient input validation to write data beyond the bounds of a buffer, potentially leading to a denial-of-service condition for the devices.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: May 27, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-416507.5An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations a CVE-2025-416519.8Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, poten CVE-2025-416529.8The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker could CVE-2025-416537.5An unauthenticated remote attacker can exploit a denial-of-service vulnerability in the device's web server functionality by sending a speci CVE-2025-416548.2An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can tri CVE-2025-416557.5An unauthenticated remote attacker can access a URL which causes the device to reboot.CVE-2025-4165610.0An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for th CVE-2025-416574.3Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible by CVE-2025-416585.5CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permiss CVE-2025-416598.3A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and CVE-2025-41666.5Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit lo CVE-2025-416608.8A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized co