CVE-2025-41650

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations and potentially cause a denial-of-service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1287

Affected software

VendorProductVersions
WeidmuellerIE-SW-VL05M-5TX>= 0.0.0, < 3.6.32
WeidmuellerIE-SW-VL05MT-5TX>= 0.0.0, < 3.6.32
WeidmuellerIE-SW-VL08MT-8TX>= 0.0.0, < 3.5.36
WeidmuellerIE-SW-VL08MT-5TX-1SC-2SCS>= 0.0.0, < 3.5.36
WeidmuellerIE-SW-VL08MT-6TX-2SC>= 0.0.0, < 3.5.36
WeidmuellerIE-SW-VL08MT-6TX-2ST>= 0.0.0, < 3.5.36
WeidmuellerIE-SW-VL08MT-6TX-2SCS>= 0.0.0, < 3.5.36
WeidmuellerIE-SW-PL10M-3GT-7TX>= 0.0.0, < 3.3.34
WeidmuellerIE-SW-PL10MT-3GT-7TX>= 0.0.0, < 3.3.34
WeidmuellerIE-SW-PL16M-16TX>= 0.0.0, < 3.4.32
WeidmuellerIE-SW-PL16MT-16TX>= 0.0.0, < 3.4.32
WeidmuellerIE-SW-PL18M-2GC-16TX>= 0.0.0, < 3.4.40
WeidmuellerIE-SW-PL18MT-2GC-16TX>= 0.0.0, < 3.4.40

References

Timeline

Published
May 27, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-416519.8Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potenCVE-2025-416529.8The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker couldCVE-2025-416537.5An unauthenticated remote attacker can exploit a denial-of-service vulnerability in the device's web server functionality by sending a speciCVE-2025-416548.2An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can triCVE-2025-416557.5An unauthenticated remote attacker can access a URL which causes the device to reboot.CVE-2025-4165610.0An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for thCVE-2025-416574.3Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible byCVE-2025-416585.5CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissCVE-2025-416598.3A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and CVE-2025-41666.5Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit loCVE-2025-416608.8A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized coCVE-2025-416618.8An unauthenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of Cross-Site Request