CVE-2025-41713

MediumCVSS 6.5/10Last modified Oct 23, 2026

Description

During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating in an undefined state until a CPU-induced reset allows proper configuration.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-1188

Affected software

VendorProductVersions
WAGOCC100 0751-9301< HW
WAGOCC100 0751-9301 HW rev. &lt;082100< 04.08.05
WAGOCC100 0751-9301/K000-0005< HW
WAGOCC100 0751-9301/K000-0005 HW rev. &lt;082100< 04.08.05
WAGOCC100 0751-9401< HW
WAGOCC100 0751-9401 HW rev. &lt;052500< 04.08.05
WAGOCC100 0751-9402< HW
WAGOCC100 0751-9402/0000-0001< HW
WAGOCC100 0751-9402/0000-0001 HW rev. &lt;052800< 04.08.05
WAGOCC100 0751-9402 HW rev. &lt;032800< 04.08.05
WAGOCC100 0751-9403< HW
WAGOCC100 0751-9403 HW rev. &lt;022800< 04.08.05
WAGOEdge Controller 0752-8303/8000-0002< HW
WAGOEdge Controller 0752-8303/8000-0002 HW rev. 32500< 04.08.05
WAGOTP600 0762-4101< HW
WAGOTP600 0762-4101 HW rev. &lt;072500< 04.08.05
WAGOTP600 0762-4102< HW
WAGOTP600 0762-4102 HW rev. &lt;072500< 04.08.05
WAGOTP600 0762-4104< HW
WAGOTP600 0762-4104 HW rev. &lt;062500< 04.08.05
WAGOTP600 0762-4201/8000-0001< HW
WAGOTP600 0762-4201/8000-0001 HW rev. &lt;072500< 04.08.05
WAGOTP600 0762-4201/8000-0002< HW
WAGOTP600 0762-4201/8000-0002< HW
WAGOTP600 0762-4201/8000-0002 HW rev. &lt;072500< 04.08.05
WAGOTP600 0762-4201/8000-0002 HW rev. &lt;072500< 04.08.05
WAGOTP600 0762-4301/8000-0002< HW
WAGOTP600 0762-4301/8000-0002 HW rev. &lt;072500< 04.08.05
WAGOTP600 0762-4302/8000-0002< HW
WAGOTP600 0762-4302/8000-0002 HW rev. &lt;072500< 04.08.05
WAGOTP600 0762-4303/8000-0002< HW
WAGOTP600 0762-4303/8000-0002 HW rev. &lt;062500< 04.08.05
WAGOTP600 0762-4304/8000-0002< HW
WAGOTP600 0762-4304/8000-0002 HW rev. &lt;062500< 04.08.05
WAGOTP600 0762-4305/8000-0002< HW
WAGOTP600 0762-4305/8000-0002 HW rev. &lt;052500< 04.08.05
WAGOTP600 0762-4306/8000-0001< HW
WAGOTP600 0762-4306/8000-0001 HW rev. &lt;042500< 04.08.05
WAGOTP600 0762-4306/8000-0002< HW
WAGOTP600 0762-4306/8000-0002 HW rev. &lt;042500< 04.08.05
WAGOTP600 0762-5201/8000-0001< HW
WAGOTP600 0762-5201/8000-0001 HW rev. &lt;062500< 04.08.05
WAGOTP600 0762-5203/8000-0001< HW
WAGOTP600 0762-5203/8000-0001 HW rev. &lt;062500< 04.08.05
WAGOTP600 0762-5204/8000-0001< HW
WAGOTP600 0762-5204/8000-0001< HW
WAGOTP600 0762-5204/8000-0001 HW rev. &lt;052500< 04.08.05
WAGOTP600 0762-5204/8000-0001 HW rev. &lt;052500< 04.08.05
WAGOTP600 0762-5205/8000-0001< HW
WAGOTP600 0762-5205/8000-0001 HW rev. &lt;032500< 04.08.05

References

Timeline

Published
Sep 15, 2025
Last modified
Oct 23, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-417148.8The upload endpoint insufficiently validates the 'Upload-Key' request header. By supplying path traversal sequences, an authenticated attackCVE-2025-417159.8The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized accCVE-2025-417165.3The web application allows an unauthenticated remote attacker to learn information about existing user accounts with their corresponding rolCVE-2025-417178.8An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leadiCVE-2025-417187.5A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain logiCVE-2025-417198.8A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters whichCVE-2025-41726.4The VerticalResponse Newsletter Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'verticalresponse'CVE-2025-417204.3A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only CVE-2025-417212.7A high privileged remote attacker can influence the parameters passed to the openssl command due to improper neutralization of special elemeCVE-2025-417227.5The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract privCVE-2025-417239.8The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction andCVE-2025-417247.5An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests. The wscserver process will not be restarted
CVE-2025-41713: Medium severity, CVSS 6.5 | Vulnix