CVE-2025-41708

Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://certvde.com/de/advisories/VDE-2025-084

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Debido a una configuración predeterminada insegura, se utiliza HTTP en lugar de HTTPS para la interfaz web. Un atacante no autenticado en la misma red podría explotar esto para conocer datos sensibles durante la transmisión.

Information

Published : 2025-09-08 07:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-41708

Mitre link : CVE-2025-41708

CVE.ORG link : CVE-2025-41708

JSON object : View

Products Affected

No product.

CWE

CWE-319

Cleartext Transmission of Sensitive Information

{"id": "CVE-2025-41708", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-41708", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-08T18:03:02.845880Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "info@cert.vde.com", "affectedData": [{"vendor": "Bender", "product": "CC612", "versions": [{"status": "affected", "version": "0.0.0", "versionType": "semver", "lessThanOrEqual": "all versions"}], "defaultStatus": "unaffected"}, {"vendor": "Bender", "product": "CC613", "versions": [{"status": "affected", "version": "0.0.0", "versionType": "semver", "lessThanOrEqual": "all versions"}], "defaultStatus": "unaffected"}, {"vendor": "Bender", "product": "ICC15xx", "versions": [{"status": "affected", "version": "0.0.0", "versionType": "semver", "lessThanOrEqual": "all versions"}], "defaultStatus": "unaffected"}, {"vendor": "Bender", "product": "ICC16xx", "versions": [{"status": "affected", "version": "0.0.0", "versionType": "semver", "lessThanOrEqual": "all versions"}], "defaultStatus": "unaffected"}, {"vendor": "Bender", "product": "ICC13xx", "versions": [{"status": "affected", "version": "0.0.0", "versionType": "semver", "lessThanOrEqual": "all versions"}], "defaultStatus": "unaffected"}]}], "published": "2025-09-08T07:15:36.523", "references": [{"url": "https://certvde.com/de/advisories/VDE-2025-084", "source": "info@cert.vde.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-319"}]}], "descriptions": [{"lang": "en", "value": "Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission."}, {"lang": "es", "value": "Debido a una configuraci\u00f3n predeterminada insegura, se utiliza HTTP en lugar de HTTPS para la interfaz web. Un atacante no autenticado en la misma red podr\u00eda explotar esto para conocer datos sensibles durante la transmisi\u00f3n."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "info@cert.vde.com"}