VulnerabilityDeferred

CVE-2025-41690

A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log.

HIGH 7.4EPSS 0.25%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.25%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive configuration settings and the ability to modify device parameters.

CVSS 3.1: 7.4 HIGHCVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS: 0.25% probability · 16th percentile
CISA KEV: Not listed
Weakness: CWE-532
Source: info@cert.vde.com

References

https://certvde.com/en/advisories/VDE-2025-068

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.