CVE-2025-41651

Weidmueller: Missing Authentication Vulnerability in Industrial Ethernet Switches

State: Published
Severity: 9.8 Critical
Published: May 27, 2025
Updated: May 27, 2025
Reserved: Apr 16, 2025

Description

Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upload or download of configuration files and leading to full system compromise.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
IE-SW-VL05M-5TXWeidmueller	0.0.0 to before 3.6.32Affected
IE-SW-VL05MT-5TXWeidmueller	0.0.0 to before 3.6.32Affected
IE-SW-VL08MT-8TXWeidmueller	0.0.0 to before 3.5.36Affected
IE-SW-VL08MT-5TX-1SC-2SCSWeidmueller	0.0.0 to before 3.5.36Affected
IE-SW-VL08MT-6TX-2SCWeidmueller	0.0.0 to before 3.5.36Affected
IE-SW-VL08MT-6TX-2STWeidmueller	0.0.0 to before 3.5.36Affected
IE-SW-VL08MT-6TX-2SCSWeidmueller	0.0.0 to before 3.5.36Affected
IE-SW-PL10M-3GT-7TXWeidmueller	0.0.0 to before 3.3.34Affected
IE-SW-PL10MT-3GT-7TXWeidmueller	0.0.0 to before 3.3.34Affected
IE-SW-PL16M-16TXWeidmueller	0.0.0 to before 3.4.32Affected
IE-SW-PL16MT-16TXWeidmueller	0.0.0 to before 3.4.32Affected
IE-SW-PL18M-2GC-16TXWeidmueller	0.0.0 to before 3.4.40Affected
IE-SW-PL18MT-2GC-16TXWeidmueller	0.0.0 to before 3.4.40Affected

References

https://certvde.com/en/advisories/VDE-2025-044/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.