by Kastro
Paper/Archive/CVE-2025-41651

CVE-2025-41651

Weidmueller IE-SW-VL05M-5TX — Weidmueller: Missing Authentication Vulnerability in Industrial Ethernet Switches

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 50.8.508 × 2010.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upload or download of configuration files and leading to full system compromise.

Affected

ProductAffectedFixed inSource
IE-SW-VL05M-5TX0.0.0 – < 3.6.323.6.32CNA
IE-SW-VL05MT-5TX0.0.0 – < 3.6.323.6.32CNA
IE-SW-VL08MT-8TX0.0.0 – < 3.5.363.5.36CNA
IE-SW-VL08MT-5TX-1SC-2SCS0.0.0 – < 3.5.363.5.36CNA
IE-SW-VL08MT-6TX-2SC0.0.0 – < 3.5.363.5.36CNA
IE-SW-VL08MT-6TX-2ST0.0.0 – < 3.5.363.5.36CNA
IE-SW-VL08MT-6TX-2SCS0.0.0 – < 3.5.363.5.36CNA
IE-SW-PL10M-3GT-7TX0.0.0 – < 3.3.343.3.34CNA
IE-SW-PL10MT-3GT-7TX0.0.0 – < 3.3.343.3.34CNA
IE-SW-PL16M-16TX0.0.0 – < 3.4.323.4.32CNA
IE-SW-PL16MT-16TX0.0.0 – < 3.4.323.4.32CNA
IE-SW-PL18M-2GC-16TX0.0.0 – < 3.4.403.4.40CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcertvde.com/en/advisories/VDE-2025-044