CVE-2025-41652

Weidmueller: Authentication Bypass Vulnerability in Industrial Ethernet Switches

State: Published
Severity: 9.8 Critical
Published: May 27, 2025
Updated: Aug 22, 2025
Reserved: Apr 16, 2025

Description

The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker could exploit this weakness by performing brute-force attacks to guess valid credentials or by using MD5 collision techniques to forge authentication hashes, potentially compromising the device.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	CERTVDE

Weaknesses

CWE-328 Use of Weak Hash

Affected Products

Product	Versions
IE-SW-VL05M-5TXWeidmueller	0.0.0 to before 3.6.32Affected
IE-SW-VL05MT-5TXWeidmueller	0.0.0 to before 3.6.32Affected
IE-SW-VL08MT-8TXWeidmueller	0.0.0 to before 3.6.32Affected
IE-SW-VL08MT-5TX-1SC-2SCSWeidmueller	0.0.0 to before 3.5.36Affected
IE-SW-VL08MT-6TX-2SCWeidmueller	0.0.0 to before 3.5.36Affected
IE-SW-VL08MT-6TX-2STWeidmueller	0.0.0 to before 3.5.36Affected
IE-SW-VL08MT-6TX-2SCSWeidmueller	0.0.0 to before 3.5.36Affected
IE-SW-PL10M-3GT-7TXWeidmueller	0.0.0 to before 3.3.34Affected
IE-SW-PL10MT-3GT-7TXWeidmueller	0.0.0 to before 3.3.34Affected
IE-SW-PL16M-16TXWeidmueller	0.0.0 to before 3.4.32Affected
IE-SW-PL16MT-16TXWeidmueller	0.0.0 to before 3.4.32Affected
IE-SW-PL18M-2GC-16TXWeidmueller	0.0.0 to before 3.4.40Affected
IE-SW-PL18MT-2GC-16TXWeidmueller	0.0.0 to before 3.4.40Affected

References

https://certvde.com/en/advisories/VDE-2025-044/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.