CVE-2025-41651CWE-306

Weidmueller: Missing Authentication Vulnerability in Industrial Ethernet Switches

Critical · published May 27, 2025

CVSS v3.1
9.8
EPSS
1%
Percentile
48.0
In the wild
Unconfirmed
What it is

🚨 An unauthenticated remote attacker can execute arbitrary commands—just like a hacker getting into your garage because you left the door wide open! 🔥 Think of this vulnerability as a secure vault, but someone forgot to install the lock. Anyone can waltz in, mess with the vault's contents, or even take everything out without breaking a sweat! This critical gap means an attacker can fully compromise your system, potentially leading to unauthorized uploads or downloads of configuration files. The consequences could be absolutely devastating—think of your vital data being held hostage or manipulated at will!

Put simply

Think of this vulnerability as a secure vault, but someone forgot to install the lock. Anyone can waltz in, mess with the vault's contents, or even take everything out without breaking a sweat! CVE-2025-41651 involves missing authentication on a critical function of devices, allowing unauthenticated remote attackers to run arbitrary commands. This could enable them to manipulate system configurations freely without any barriers.

What to do

This critical gap means an attacker can fully compromise your system, potentially leading to unauthorized uploads or downloads of configuration files. The consequences could be absolutely devastating—think of your vital data being held hostage or manipulated at will! To protect your systems, immediately implement authentication on all critical functions, and review security policies to ensure proper measures are in place. Consider upgrading to the latest firmware that includes security patches for this vulnerability. You've got this! With swift action, you can lock down your system and keep those attackers at bay! 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00600 · 48.0th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2025-05-27T08:38Z
EPSS history
Timeline
  • 27 MAY 08:38Z
    Weidmueller: Missing Authentication Vulnerability in Industrial Ethernet Switches
    cvelistv5