8.8

CVE-2025-41668

Phoenix Contact: File access due to the replacement of a critical file used by the service security-profile

A low privileged remote attacker with file access can replace a critical file or folder used by the service security-profile to get read, write and execute access to any file on the device.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerPHOENIX CONTACT
≫
Produkt AXC F 1152
Default Statusunaffected
Version 0
Version < 2025.0.2
Status affected
HerstellerPHOENIX CONTACT
≫
Produkt AXC F 2152
Default Statusunaffected
Version 0
Version < 2025.0.2
Status affected
HerstellerPHOENIX CONTACT
≫
Produkt AXC F 3152
Default Statusunaffected
Version 0
Version < 2025.0.2
Status affected
HerstellerPHOENIX CONTACT
≫
Produkt BPC 9102S
Default Statusunaffected
Version 0
Version < 2025.0.2
Status affected
HerstellerPHOENIX CONTACT
≫
Produkt RFC 4072S
Default Statusunaffected
Version 0
Version < 2025.0.2
Status affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.51% 0.407
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
info@cert.vde.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-59 Improper Link Resolution Before File Access ('Link Following')

The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

https://certvde.com/en/advisories/VDE-2025-054