CVE-2025-41656
BaseFortify
Publication date: 2025-07-01
Last updated on: 2025-07-03
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-41656 is a critical security vulnerability in the Pilz IndustrialPI 4 device where the integrated Node-RED server does not have authentication configured by default. This allows an unauthenticated remote attacker to gain full access to the Node-RED server and execute arbitrary operating system commands with high privileges on the device, potentially compromising the entire system. [1]
How can this vulnerability impact me? :
An attacker exploiting this vulnerability can remotely execute arbitrary commands with high privileges on the affected device without any authentication. This can lead to full system compromise, including viewing, creating, and modifying Node-RED flows, which may result in loss of confidentiality, integrity, and availability of the system. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection can involve checking if the Node-RED server on the Pilz IndustrialPI 4 device is running without authentication enabled. Since the Node-RED service must be enabled via the device's web application, you can attempt to access the Node-RED server remotely to see if authentication is required. For example, using curl or a web browser to access the Node-RED web interface on the device's IP and port may reveal if authentication is missing. Specific commands are not detailed in the provided resources. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting network access to the IndustrialPI device by using firewalls or similar network controls to prevent unauthorized remote access. For remediation, enable authentication on the Node-RED server as detailed in the Pilz PDF guide. Note that enabling authentication requires the Node-RED service to be activated via the device's web application. [1]