CVE-2025-41718
BaseFortify
Publication date: 2025-10-14
Last updated on: 2025-10-14
Assigner: CERT VDE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| murrelektronik | impact67_pro | 1.08.01 |
| murrelektronik | impact67_pro | 1.08.05 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-319 | The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-41718 is a vulnerability in the embedded web interface of certain Murrelektronik IMPACT67 Pro devices where sensitive information, specifically user login credentials, is transmitted in cleartext over unencrypted HTTP GET requests. Because the device does not support HTTPS/TLS, an attacker on the same network segment can passively intercept these credentials and gain unauthorized access to the device's Web-UI. [1]
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized remote attackers capturing your login credentials and accessing the device's Web-UI. This compromises the confidentiality of your data and may result in leakage of personal user information. Additionally, if passwords are reused, attackers could potentially access other services using the compromised credentials. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring network traffic for unencrypted HTTP GET requests to the affected device's webserver that contain user login credentials in cleartext. Network packet capture tools like tcpdump or Wireshark can be used to identify such traffic. For example, using tcpdump, you can run: tcpdump -i <interface> -A 'tcp port 80' and look for HTTP GET requests containing login parameters. This indicates the presence of cleartext credential transmission. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include disabling the webserver on the affected devices to prevent unencrypted data transmission, deactivating any unused network ports, implementing strict network segmentation to limit unauthorized access to the devices, and advising users to avoid using personal or standard passwords for the webserver accounts to reduce the risk of credential compromise. [1]