CVE-2025-41683CWE-78

Weidmueller: Root Command Injection via Unsanitized Input in event_mail_test Endpoint

High · published July 23, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
56.4
In the wild
Unconfirmed
What it is

An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint event_mail_test).

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00806 · 56.4th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-07-23T08:22Z
EPSS history
Timeline
  • 23 JUL 08:22Z
    Weidmueller: Root Command Injection via Unsanitized Input in event_mail_test Endpoint
    cvelistv5