CVE-2025-41731

A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the debug interface is still enabled.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.4 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://jumo.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-086.json

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad fue identificada en el algoritmo de generación de contraseñas al acceder a la interfaz de depuración. Un atacante local no autenticado con conocimiento del marco de tiempo de generación de contraseñas podría ser capaz de forzar la contraseña por fuerza bruta de manera oportuna y así obtener acceso de root al dispositivo si la interfaz de depuración todavía está habilitada.

Information

Published : 2025-11-10 08:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-41731

Mitre link : CVE-2025-41731

CVE.ORG link : CVE-2025-41731

JSON object : View

Products Affected

No product.

CWE

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

{"id": "CVE-2025-41731", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-41731", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-10T15:18:58.302257Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.4}]}, "affected": [{"source": "info@cert.vde.com", "affectedData": [{"vendor": "Jumo", "product": "variTRON300", "versions": [{"status": "affected", "version": "0.0.0.0", "lessThan": "9.0.2.5", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Jumo", "product": "variTRON500", "versions": [{"status": "affected", "version": "0.0.0.0", "lessThan": "9.0.2.5", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Jumo", "product": "variTRON500 touch", "versions": [{"status": "affected", "version": "0.0.0.0", "lessThan": "9.0.2.5", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-10T08:15:33.957", "references": [{"url": "https://jumo.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-086.json", "source": "info@cert.vde.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-338"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the debug interface is still enabled."}, {"lang": "es", "value": "Una vulnerabilidad fue identificada en el algoritmo de generaci\u00f3n de contrase\u00f1as al acceder a la interfaz de depuraci\u00f3n. Un atacante local no autenticado con conocimiento del marco de tiempo de generaci\u00f3n de contrase\u00f1as podr\u00eda ser capaz de forzar la contrase\u00f1a por fuerza bruta de manera oportuna y as\u00ed obtener acceso de root al dispositivo si la interfaz de depuraci\u00f3n todav\u00eda est\u00e1 habilitada."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "info@cert.vde.com"}