VulnerabilityDeferred

CVE-2025-0417

The possibility to make an arbitrary number of login attempts without any rate limit gives an attacker an increased chance of guessing passwords and then performing switching operations.

HIGH 7.0EPSS 0.17%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Lack of protection against brute force attacks in Valmet DNA visualization in DNA Operate. The possibility to make an arbitrary number of login attempts without any rate limit gives an attacker an increased chance of guessing passwords and then performing switching operations.

CVSS 4.0: 7.0 HIGHCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.17% probability · 6th percentile
CISA KEV: Not listed
Weakness: CWE-307
Source: db4dfee8-a97e-4877-bfae-eba6d14a2166

References

https://www.valmet.com/about-us/about/research-and-development/vulnerabilityadvisories/cve-2025-0417/

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.