CVE-2025-41654 - Vulnerability Details - OpenCVE

An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can trigger a reboot by the watchdog.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2025-011

History

Fri, 22 Aug 2025 10:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-200

Fri, 22 Aug 2025 09:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-306

Tue, 27 May 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 26 May 2025 08:30:00 +0000

Type	Values Removed	Values Added
Description		An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can trigger a reboot by the watchdog.
Title		PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL – Device is affected by information disclosure via the SNMP protocol
Weaknesses		CWE-200
References		https://cert.vde.com/en/advisories/VDE-2025-011
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2025-05-26T08:21:54.033Z

Updated: 2025-08-22T09:18:26.543Z

Reserved: 2025-04-16T11:17:48.306Z

Link: CVE-2025-41654

Vulnrichment

Updated: 2025-05-27T14:13:51.009Z

NVD

Status : Awaiting Analysis

Published: 2025-05-26T09:15:20.883

Modified: 2025-08-22T10:15:32.610

Link: CVE-2025-41654

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-41654", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2025-04-16T11:17:48.306Z", "datePublished": "2025-05-26T08:21:54.033Z", "dateUpdated": "2025-08-22T09:18:26.543Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Profinet Gateway FB8122A.1.EL", "vendor": "Pepperl+Fuchs", "versions": [{"lessThan": "V1.3.13", "status": "affected", "version": "0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "Profinet Gateway LB8122A.1.EL", "vendor": "Pepperl+Fuchs", "versions": [{"lessThan": "V1.3.13", "status": "affected", "version": "0", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can trigger a reboot by the watchdog."}], "value": "An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can trigger a reboot by the watchdog."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-08-22T09:18:26.543Z"}, "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2025-011"}], "source": {"advisory": "VDE-2025-011", "defect": ["CERT@VDE#641711"], "discovery": "UNKNOWN"}, "title": "PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL \u2013 Device is affected by information disclosure via the SNMP protocol", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-05-27T14:13:48.803600Z", "id": "CVE-2025-41654", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-27T14:13:53.729Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-41654", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-27T14:13:48.803600Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-27T14:13:51.009Z"}}], "cna": {"title": "PEPPERL+FUCHS: Profinet Gateway LB8122A.1.EL \u2013 Device is affected by information disclosure via the SNMP protocol", "source": {"defect": ["CERT@VDE#641711"], "advisory": "VDE-2025-011", "discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Pepperl+Fuchs", "product": "Profinet Gateway FB8122A.1.EL", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.3.13", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Pepperl+Fuchs", "product": "Profinet Gateway LB8122A.1.EL", "versions": [{"status": "affected", "version": "0", "lessThan": "V1.3.13", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2025-011"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can trigger a reboot by the watchdog.", "supportingMedia": [{"type": "text/html", "value": "An unauthenticated remote attacker can access information about running processes via the SNMP protocol. The amount of returned data can trigger a reboot by the watchdog.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-08-22T09:18:26.543Z"}}}, "cveMetadata": {"cveId": "CVE-2025-41654", "state": "PUBLISHED", "dateUpdated": "2025-08-22T09:18:26.543Z", "dateReserved": "2025-04-16T11:17:48.306Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2025-05-26T08:21:54.033Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.1"}