CVE-2025-41653

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker can exploit a denial-of-service vulnerability in the device's web server functionality by sending a specially crafted HTTP request with a malicious header, potentially causing the server to crash or become unresponsive.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-410

Affected software

Vendor	Product	Versions
Weidmueller	IE-SW-VL05M-5TX	>= 0.0.0, < 3.6.32
Weidmueller	IE-SW-VL05MT-5TX	>= 0.0.0, < 3.6.32
Weidmueller	IE-SW-VL08MT-8TX	>= 0.0.0, < 3.5.36
Weidmueller	IE-SW-VL08MT-5TX-1SC-2SCS	>= 0.0.0, < 3.5.36
Weidmueller	IE-SW-VL08MT-6TX-2SC	>= 0.0.0, < 3.5.36
Weidmueller	IE-SW-VL08MT-6TX-2ST	>= 0.0.0, < 3.5.36
Weidmueller	IE-SW-VL08MT-6TX-2SCS	>= 0.0.0, < 3.5.36
Weidmueller	IE-SW-PL10M-3GT-7TX	>= 0.0.0, < 3.3.34
Weidmueller	IE-SW-PL10MT-3GT-7TX	>= 0.0.0, < 3.3.34
Weidmueller	IE-SW-PL16M-16TX	>= 0.0.0, < 3.4.32
Weidmueller	IE-SW-PL16MT-16TX	>= 0.0.0, < 3.4.32
Weidmueller	IE-SW-PL18M-2GC-16TX	>= 0.0.0, < 3.4.40
Weidmueller	IE-SW-PL18MT-2GC-16TX	>= 0.0.0, < 3.4.40

References

https://certvde.com/en/advisories/VDE-2025-044/

Timeline

Published: May 27, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-416548.2An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can tri CVE-2025-416557.5An unauthenticated remote attacker can access a URL which causes the device to reboot.CVE-2025-4165610.0An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for th CVE-2025-416574.3Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible by CVE-2025-416585.5CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permiss CVE-2025-416598.3A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and CVE-2025-41666.5Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit lo CVE-2025-416608.8A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized co CVE-2025-416618.8An unauthenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of Cross-Site Request CVE-2025-416639.8For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary commands in responses retu CVE-2025-416647.5A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper pe CVE-2025-416656.5An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions of