VulnerabilityDeferred

CVE-2025-41648

An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.

CRITICAL 9.8EPSS 0.72%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

An unauthenticated remote attacker can bypass the login to the web application of the affected devices making it possible to access and change all available settings of the IndustrialPI.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.72% probability · 52th percentile
CISA KEV: Not listed
Weakness: CWE-704
Source: info@cert.vde.com

References

https://certvde.com/en/advisories/VDE-2025-039

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.