by Kastro
Paper/Archive/CVE-2025-41652

CVE-2025-41652

Weidmueller IE-SW-VL05M-5TX — Weidmueller: Authentication Bypass Vulnerability in Industrial Ethernet Switches

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 42.2.422 × 208.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker could exploit this weakness by performing brute-force attacks to guess valid credentials or by using MD5 collision techniques to forge authentication hashes, potentially compromising the device.

Affected

ProductAffectedFixed inSource
IE-SW-VL05M-5TX0.0.0 – < 3.6.323.6.32CNA
IE-SW-VL05MT-5TX0.0.0 – < 3.6.323.6.32CNA
IE-SW-VL08MT-8TX0.0.0 – < 3.6.323.6.32CNA
IE-SW-VL08MT-5TX-1SC-2SCS0.0.0 – < 3.5.363.5.36CNA
IE-SW-VL08MT-6TX-2SC0.0.0 – < 3.5.363.5.36CNA
IE-SW-VL08MT-6TX-2ST0.0.0 – < 3.5.363.5.36CNA
IE-SW-VL08MT-6TX-2SCS0.0.0 – < 3.5.363.5.36CNA
IE-SW-PL10M-3GT-7TX0.0.0 – < 3.3.343.3.34CNA
IE-SW-PL10MT-3GT-7TX0.0.0 – < 3.3.343.3.34CNA
IE-SW-PL16M-16TX0.0.0 – < 3.4.323.4.32CNA
IE-SW-PL16MT-16TX0.0.0 – < 3.4.323.4.32CNA
IE-SW-PL18M-2GC-16TX0.0.0 – < 3.4.403.4.40CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcertvde.com/en/advisories/VDE-2025-044