VulnerabilityAwaiting Analysis

CVE-2025-41771

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection.

MEDIUM 5.3EPSS 0.18%

Does this matter?

Lower severity and a low EPSS score (0.18%). Track it; it rarely justifies an emergency change on its own.

Description

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite database used only for storing notification messages. Therefore, the impact is limited to the system’s notification functionality.

CVSS 4.0: 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.18% probability · 8th percentile
CISA KEV: Not listed
Weakness: CWE-89
Source: info@cert.vde.com

References

https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-056.json

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.