Arbitrary Data Write Vulnerability in Check Account Function for Unspecified Product by Vendor
CVE-2025-41730

8.8HIGH

Key Information:

Vendor

Wago

Status
Indsutrial-managed-switches
Vendor
CVE Published:
10 December 2025

What is CVE-2025-41730?

An unauthenticated remote attacker can exploit unsafe buffer handling in the check_account() function, enabling arbitrary data to be written into fixed-size stack buffers. This vulnerability poses a risk of full device compromise, allowing malicious actors to execute potentially harmful actions on the affected systems.

Affected Version(s)

Indsutrial-Managed-Switches 0.0.0 < 02.64

References

https://certvde.com/de/advisories/VDE-2025-095

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Daniel Hulliger from The Cyber-Defence Campus of armasuisse S+T
JSON
.
CVE-2025-41730 : Arbitrary Data Write Vulnerability in Check Account Function for Unspecified Product by Vendor