CVE-2025-41753

The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.certvde.com/en/advisories/VDE-2025-102/

Configurations

No configuration.

History

14 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) El nombre del objeto de un objeto de archivo BACnet creado dinámicamente se interpreta como una ruta de archivo sin validación suficiente. Debido a que las rutas relativas no están limitadas al directorio previsto, un atacante remoto no autenticado puede atravesar fuera de él y leer o sobrescribir archivos arbitrarios en el dispositivo, lo que puede llevar a un compromiso total del sistema.

01 Oct 2026, 07:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-01 07:16

Updated : 2026-10-14 13:10

NVD link : CVE-2025-41753

Mitre link : CVE-2025-41753

CVE.ORG link : CVE-2025-41753

JSON object : View

Products Affected

No product.

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-41753", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-41753", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-01T19:11:00.419667Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "info@cert.vde.com", "affectedData": [{"vendor": "WAGO", "product": "0751-9x01", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0750-811x-xxxx-xxxx", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0750-821x-xxx-xxx", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0762-420x-8000-000x", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0762-430x-8000-000x", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0762-520x-8000-000x", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0762-530x-8000-000x", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0762-620x-8000-000x", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0762-630x-8000-000x", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0752-8303-8000-0002", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0762-340x", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0751-9x01", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9 (70)", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0750-811x-xxxx-xxxx", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9 (70)", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0750-821x-xxx-xxx", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9 (70)", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0762-420x-8000-000x", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9 (70)", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0762-430x-8000-000x", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9 (70)", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0762-520x-8000-000x", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9 (70)", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0762-530x-8000-000x", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9 (70)", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0762-620x-8000-000x", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9 (70)", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0762-630x-8000-000x", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9 (70)", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0752-8303-8000-0002", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9 (70)", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "0762-340x", "versions": [{"status": "affected", "version": "1.0.0", "lessThan": "4.8.9 (70)", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-01T07:16:32.473", "references": [{"url": "https://www.certvde.com/en/advisories/VDE-2025-102/", "source": "info@cert.vde.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise."}, {"lang": "es", "value": "El nombre del objeto de un objeto de archivo BACnet creado din\u00e1micamente se interpreta como una ruta de archivo sin validaci\u00f3n suficiente. Debido a que las rutas relativas no est\u00e1n limitadas al directorio previsto, un atacante remoto no autenticado puede atravesar fuera de \u00e9l y leer o sobrescribir archivos arbitrarios en el dispositivo, lo que puede llevar a un compromiso total del sistema."}], "lastModified": "2026-10-14T13:10:00.187", "sourceIdentifier": "info@cert.vde.com"}