« Volver al listado

CVE-2025-41717

Estado: AplazadaAlta (8.8)—

An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to improper control of code generation ('Code Injection’).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS con UI:R indica ejecución en cliente (T1203). CWE-94 (Code Injection) y descripción confirman ejecución de código como root. El atacante engaña al usuario para subir payload malicioso, resultando en inyección de código y escalada a máximos privilegios.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareThreat Intelligence ProgramRestrict Web-Based Content

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-41717",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-41717",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-13T14:22:52.131453Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "Phoenix Contact",
          "product": "TC ROUTER 3002T-3G",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.08.8",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Phoenix Contact",
          "product": "TC ROUTER 2002T-3G",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.08.8",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Phoenix Contact",
          "product": "TC ROUTER 3002T-4G",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.08.8",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Phoenix Contact",
          "product": "TC ROUTER 3002T-4G GL",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.08.8",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Phoenix Contact",
          "product": "TC ROUTER 5004T-5G EU",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "1.06.23",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Phoenix Contact",
          "product": "TC ROUTER 3002T-4G VZW",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.08.8",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Phoenix Contact",
          "product": "TC ROUTER 3002T-4G ATT",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.08.8",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Phoenix Contact",
          "product": "TC ROUTER 2002T-4G",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.08.8",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Phoenix Contact",
          "product": "CLOUD CLIENT 1101T-TX/TX",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.07.7",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Phoenix Contact",
          "product": "TC CLOUD CLIENT 1002-4G ATT",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.08.8",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Phoenix Contact",
          "product": "TC CLOUD CLIENT 1002-TX/TX",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "3.07.7",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-01-13T08:16:03.993",
  "references": [
    {
      "url": "https://certvde.com/de/advisories/VDE-2025-073",
      "source": "info@cert.vde.com"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2026/Feb/3",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to improper control of code generation ('Code Injection’)."
    },
    {
      "lang": "es",
      "value": "Un atacante remoto no autenticado puede engañar a un usuario con altos privilegios para que cargue una carga útil maliciosa a través del endpoint config-upload, lo que lleva a la inyección de código como root. Esto resulta en una pérdida total de confidencialidad, disponibilidad e integridad debido a un control inadecuado de la generación de código ('Inyección de Código')."
    }
  ],
  "lastModified": "2026-06-17T09:23:01.813",
  "sourceIdentifier": "info@cert.vde.com"
}