CVE-2025-41647
BaseFortify
Publication date: 2025-06-25
Last updated on: 2025-06-26
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-312 | The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in Lenze SE's PLC Designer V4 software (version 4.0.0) allows a local, low-privileged attacker to see the password of the connected controller because the password is displayed in plain text within the software interface under certain conditions. This happens due to insecure storage and incorrect implementation, exposing sensitive information on the engineering workstation's display. [1]
How can this vulnerability impact me? :
The vulnerability poses a confidentiality risk by allowing an attacker with local access and low privileges to view the controller's password in plain text on the engineering workstation. This could lead to unauthorized access to the controller if the password is compromised. However, the password management on the actual device is not affected. The impact is limited to information disclosure without affecting integrity or availability. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the PLC Designer V4 software version 4.0.0 is in use, especially when connected to c430, c520, or c550 controllers. Since the password is displayed in plain text within the software interface under certain conditions, detection involves verifying the software version and inspecting the interface for exposed passwords. There are no specific network or system commands provided to detect this vulnerability. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating PLC Designer V4 to version 4.0.1 where the vulnerability is resolved, using the tool only in secure and controlled environments, and protecting the viewing area to prevent unauthorized individuals from seeing the displayed passwords (e.g., preventing shoulder surfing). [1]