CVE-2025-41684CWE-78

Weidmueller: Root Command Injection via Unsanitized Input in tls_iotgen_setting Endpoint

High · published July 23, 2025

CVSS v3.1
8.8
EPSS
1%
Percentile
56.3
In the wild
Unconfirmed
What it is

An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint tls_iotgen_setting).

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00806 · 56.3th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-07-23T08:23Z
EPSS history
Timeline
  • 23 JUL 08:23Z
    Weidmueller: Root Command Injection via Unsanitized Input in tls_iotgen_setting Endpoint
    cvelistv5