by Kastro
Paper/Archive/CVE-2025-41715

CVE-2025-41715

WAGO Device Sphere — Missing Authentication for Database Access in Web Application

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 42.3.423 × 208.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The database for the web application is exposed without authentication, allowing an unauthenticated remote attacker to gain unauthorized access and potentially compromise it.

Affected

ProductAffectedFixed inSource
Device Sphere0.0.0 – < 1.1.01.1.0CNA
Solution Builder0.0.0 – < 2.3.32.3.3CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcertvde.com/de/advisories/VDE-2025-087