Total
398612 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-41698 | 2026-06-17 | N/A | 7.8 HIGH | ||
| A low privileged local attacker can interact with the affected service although user-interaction should not be allowed. | |||||
| CVE-2025-41697 | 1 Phoenixcontact | 137 Fl Nat 2008, Fl Nat 2008 Firmware, Fl Nat 2208 and 134 more | 2026-06-17 | N/A | 6.8 MEDIUM |
| An attacker can use an undocumented UART port on the PCB as a side-channel to get root access e.g. with the credentials obtained from CVE-2025-41692. | |||||
| CVE-2025-41696 | 1 Phoenixcontact | 137 Fl Nat 2008, Fl Nat 2008 Firmware, Fl Nat 2208 and 134 more | 2026-06-17 | N/A | 4.6 MEDIUM |
| An attacker can use an undocumented UART port on the PCB as a side-channel with the user hardcoded credentials obtained from CVE-2025-41692 to gain read access to parts of the filesystem of the device. | |||||
| CVE-2025-41695 | 1 Phoenixcontact | 137 Fl Nat 2008, Fl Nat 2008 Firmware, Fl Nat 2208 and 134 more | 2026-06-17 | N/A | 7.1 HIGH |
| An XSS vulnerability in dyn_conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management (WBM). The vulnerability does not provide access to system-level resources such as operating system internals or privileged functions. Access is limited to device configuration parameters that are available in the context of the web application. The session cookie is secured by the httpOnly Flag. Therefore an attacker is not able to take over the session of an authenticated user. | |||||
| CVE-2025-41694 | 1 Phoenixcontact | 137 Fl Nat 2008, Fl Nat 2008 Firmware, Fl Nat 2208 and 134 more | 2026-06-17 | N/A | 6.5 MEDIUM |
| A low privileged remote attacker can run the webshell with an empty command containing whitespace. The server will then block until it receives more data, resulting in a DoS condition of the websserver. | |||||
| CVE-2025-41693 | 1 Phoenixcontact | 137 Fl Nat 2008, Fl Nat 2008 Firmware, Fl Nat 2208 and 134 more | 2026-06-17 | N/A | 4.3 MEDIUM |
| A low privileged remote attacker can use the ssh feature to execute commands directly after login. The process stays open and uses resources which leads to a reduced performance of the management functions. Switching functionality is not affected. | |||||
| CVE-2025-41692 | 1 Phoenixcontact | 137 Fl Nat 2008, Fl Nat 2008 Firmware, Fl Nat 2208 and 134 more | 2026-06-17 | N/A | 6.8 MEDIUM |
| A high privileged remote attacker with admin privileges for the webUI can brute-force the "root" and "user" passwords of the underlying OS due to a weak password generation algorithm. | |||||
| CVE-2025-41691 | 2026-06-17 | N/A | 7.5 HIGH | ||
| An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communication requests, potentially leading to a denial-of-service (DoS) condition. | |||||
| CVE-2025-41690 | 2026-06-17 | N/A | 7.4 HIGH | ||
| A low-privileged attacker in bluetooth range may be able to access the password of a higher-privilege user (Maintenance) by viewing the device’s event log. This vulnerability could allow the Operator to authenticate as the Maintenance user, thereby gaining unauthorized access to sensitive configuration settings and the ability to modify device parameters. | |||||
| CVE-2025-41689 | 2026-06-17 | N/A | 7.5 HIGH | ||
| An unauthenticated remote attacker can get access without password protection to the affected device. This enables the unprotected read-only access to the stored measurement data. | |||||
| CVE-2025-41688 | 2026-06-17 | N/A | 7.2 HIGH | ||
| A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox. | |||||
| CVE-2025-41687 | 2026-06-17 | N/A | 9.8 CRITICAL | ||
| An unauthenticated remote attacker may use a stack based buffer overflow in the u-link Management API to gain full access on the affected devices. | |||||
| CVE-2025-41686 | 2026-06-17 | N/A | 7.8 HIGH | ||
| A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access. | |||||
| CVE-2025-41685 | 2026-06-17 | N/A | 6.5 MEDIUM | ||
| A low-privileged remote attacker can obtain the username of another registered Sunny Portal user by entering that user's email address. | |||||
| CVE-2025-41684 | 2026-06-17 | N/A | 8.8 HIGH | ||
| An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint tls_iotgen_setting). | |||||
| CVE-2025-41683 | 2026-06-17 | N/A | 8.8 HIGH | ||
| An authenticated remote attacker can execute arbitrary commands with root privileges on affected devices due to lack of improper sanitizing of user input in the Main Web Interface (endpoint event_mail_test). | |||||
| CVE-2025-41682 | 2026-06-17 | N/A | 8.8 HIGH | ||
| An authenticated, low-privileged attacker can obtain credentials stored on the charge controller including the manufacturer password. | |||||
| CVE-2025-41681 | 1 Mbconnectline | 2 Mbnet.mini, Mbnet.mini Firmware | 2026-06-17 | N/A | 4.8 MEDIUM |
| A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content. | |||||
| CVE-2025-41679 | 1 Mbconnectline | 2 Mbnet.mini, Mbnet.mini Firmware | 2026-06-17 | N/A | 5.3 MEDIUM |
| An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service. | |||||
| CVE-2025-41678 | 1 Mbconnectline | 2 Mbnet.mini, Mbnet.mini Firmware | 2026-06-17 | N/A | 6.5 MEDIUM |
| A high privileged remote attacker can alter the configuration database via POST requests due to improper neutralization of special elements used in a SQL statement. | |||||