Local Privilege Escalation in PLC Designer V4 by Vendor
CVE-2025-41647

5.5MEDIUM

Key Information:

Vendor

Lenze

Status
Plc Designer V4
Vendor
CVE Published:
25 June 2025

What is CVE-2025-41647?

A local, low-privileged attacker can exploit a flaw in PLC Designer V4 to retrieve the password of the connected controller. This vulnerability arises from improper implementation, allowing the password to be revealed in plain text under certain conditions. Users of PLC Designer V4 are advised to review their security measures to prevent unauthorized access to sensitive information.

Affected Version(s)

PLC Designer V4 0.0.0 <= 4.0.0

References

https://certvde.com/en/advisories/VDE-2025-043/

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-41647 : Local Privilege Escalation in PLC Designer V4 by Vendor