CVE-2025-41438
Consilium Safety CS5000 Fire Panel Initialization of a Resource with an Insecure Default
- State
- Published
- Severity
- 9.3 Critical
- Published
- May 29, 2025
- Updated
- May 30, 2025
- Reserved
- May 15, 2025
Description
The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, it has remained unchanged on every installed system observed. This account is not root but holds high-level permissions that could severely impact the device's operation if exploited.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 9.3 Critical | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | icscert |
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | icscert |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
CS5000 Fire PanelConsilium Safety |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.