CVE-2025-41733

CriticalCVSS 9.8/10Last modified Oct 18, 2026

Description

The commissioning wizard on the affected devices does not validate if the device is already initialized. An unauthenticated remote attacker can construct POST requests to set root credentials.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-305

Affected software

No affected versions have been published.

Timeline

Published: Nov 18, 2025
Last modified: Oct 18, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-417349.8An unauthenticated remote attacker can execute arbitrary php files and gain full access of the affected devices.CVE-2025-417358.8A low privileged remote attacker can upload any file to an arbitrary location due to missing file check resulting in remote code execution.CVE-2025-417368.8A low privileged remote attacker can upload a new or overwrite an existing python script by using a path traversal of the target filename in CVE-2025-417377.5Due to webserver misconfiguration an unauthenticated remote attacker is able to read the source of php modules.CVE-2025-417387.5An unauthenticated remote attacker may cause the visualisation server of the CODESYS Control runtime system to access a resource with a poin CVE-2025-417395.9An unauthenticated remote attacker, who beats a race condition, can exploit a flaw in the communication servers of the CODESYS Control runti CVE-2025-41749.8A vulnerability, which was classified as critical, has been found in PHPGurukul COVID19 Testing Management System 1.0. Affected by this issu CVE-2025-417429.8Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptogr CVE-2025-417434.0Insufficient encryption strength in Sprecher Automation SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 allows a local unprivileged attacker to e CVE-2025-417449.1Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted com CVE-2025-417457.1An XSS vulnerability in pxc_portCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipul CVE-2025-417467.1An XSS vulnerability in pxc_portSecCfg.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipu