CVE-2025-41655

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An unauthenticated remote attacker can access a URL which causes the device to reboot.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
May 26, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-4165610.0An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for thCVE-2025-416574.3Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible byCVE-2025-416585.5CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissCVE-2025-416598.3A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and CVE-2025-41666.5Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit loCVE-2025-416608.8A low-privileged remote attacker may be able to replace the boot application of the CODESYS Control runtime system, enabling unauthorized coCVE-2025-416618.8An unauthenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of Cross-Site RequestCVE-2025-416639.8For u-link Management API an unauthenticated remote attacker in a man-in-the-middle position can inject arbitrary commands in responses retuCVE-2025-416647.5A low-privileged remote attacker could gain unauthorized access to critical resources, such as firmware and certificates, due to improper peCVE-2025-416656.5An low privileged remote attacker can enforce the watchdog of the affected devices to reboot the PLC due to incorrect default permissions ofCVE-2025-416668.8A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to CVE-2025-416678.8A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute
CVE-2025-41655: High severity, CVSS 7.5 | Vulnix