CVE-2025-41662 - Vulnerability Details - OpenCVE

An unauthenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of Cross-Site Request Forgery (CSRF) protection in the Main Web Interface (endpoint tls_iotgen_setting).

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://certvde.com/en/advisories/VDE-2025-052

History

Wed, 11 Jun 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 11 Jun 2025 08:30:00 +0000

Type	Values Removed	Values Added
Description		An unauthenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of Cross-Site Request Forgery (CSRF) protection in the Main Web Interface (endpoint tls_iotgen_setting).
Title		Weidmueller: Security routers IE-SR-2TX are affected by Cross-Site Request Forgery
Weaknesses		CWE-352
References		https://certvde.com/en/advisories/VDE-2025-052
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2025-06-11T08:08:17.544Z

Updated: 2025-06-11T13:14:12.196Z

Reserved: 2025-04-16T11:17:48.307Z

Link: CVE-2025-41662

Vulnrichment

Updated: 2025-06-11T13:14:07.669Z

NVD

Status : Awaiting Analysis

Published: 2025-06-11T09:15:22.480

Modified: 2025-06-12T16:06:20.180

Link: CVE-2025-41662

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-41662", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2025-04-16T11:17:48.307Z", "datePublished": "2025-06-11T08:08:17.544Z", "dateUpdated": "2025-06-11T13:14:12.196Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "IE-SR-2TX-WL", "vendor": "Weidmueller", "versions": [{"lessThan": "V1.49", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "IE-SR-2TX-WL-4G-EU", "vendor": "Weidmueller", "versions": [{"lessThan": "V1.62", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "IE-SR-2TX-WL-4G-US-V", "vendor": "Weidmueller", "versions": [{"lessThan": "V1.62", "status": "affected", "version": "0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "ONEKEY Research Labs"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An unauthenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of Cross-Site Request Forgery (CSRF) protection in the Main Web Interface (endpoint tls_iotgen_setting)."}], "value": "An unauthenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of Cross-Site Request Forgery (CSRF) protection in the Main Web Interface (endpoint tls_iotgen_setting)."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-06-11T08:11:30.422Z"}, "references": [{"url": "https://certvde.com/en/advisories/VDE-2025-052"}], "source": {"advisory": "VDE-2025-052", "defect": ["CERT@VDE#641805"], "discovery": "UNKNOWN"}, "title": "Weidmueller: Security routers IE-SR-2TX are affected by Cross-Site Request Forgery", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-11T13:14:05.696791Z", "id": "CVE-2025-41662", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-11T13:14:12.196Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-41662", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-06-11T13:14:05.696791Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-11T13:14:07.669Z"}}], "cna": {"title": "Weidmueller: Security routers IE-SR-2TX are affected by Cross-Site Request Forgery", "source": {"defect": ["CERT@VDE#641805"], "advisory": "VDE-2025-052", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "ONEKEY Research Labs"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Weidmueller", "product": "IE-SR-2TX-WL", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.49", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Weidmueller", "product": "IE-SR-2TX-WL-4G-EU", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.62", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Weidmueller", "product": "IE-SR-2TX-WL-4G-US-V", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.62", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://certvde.com/en/advisories/VDE-2025-052"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of Cross-Site Request Forgery (CSRF) protection in the Main Web Interface (endpoint tls_iotgen_setting).", "supportingMedia": [{"type": "text/html", "value": "An unauthenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of Cross-Site Request Forgery (CSRF) protection in the Main Web Interface (endpoint tls_iotgen_setting).", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-352", "description": "CWE-352 Cross-Site Request Forgery (CSRF)"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-06-11T08:11:30.422Z"}}}, "cveMetadata": {"cveId": "CVE-2025-41662", "state": "PUBLISHED", "dateUpdated": "2025-06-11T13:14:12.196Z", "dateReserved": "2025-04-16T11:17:48.307Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2025-06-11T08:08:17.544Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.1"}