« Volver al listado

CVE-2025-41730

Estado: AnalizadaCrítica (9.8)—

An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS:N/AC:L/PR:N/UI:N indica red sin autenticación. Buffer overflow en sscanf (CWE-121, CWE-787) permite escritura arbitraria en stack, resultando en ejecución de código remota y compromi so total del dispositivo WAGO.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability Scanning

Tecnologías afectadas (2)

Wago — 0852-1322 FirmwareWago — 0852-1328 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-41730",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-41730",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-18T20:40:30.412818Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "WAGO",
          "product": "Indsutrial-Managed-Switches",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "02.64",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-12-10T11:15:47.120",
  "references": [
    {
      "url": "https://certvde.com/de/advisories/VDE-2025-095",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "info@cert.vde.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise."
    },
    {
      "lang": "es",
      "value": "Un atacante remoto no autenticado puede abusar de llamadas sscanf inseguras dentro de la función check_account() para escribir datos arbitrarios en búferes de pila de tamaño fijo, lo que lleva al compromiso total del dispositivo."
    }
  ],
  "lastModified": "2026-09-25T23:10:00.463",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wago:0852-1328_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "402B0083-E354-4B25-82E4-1A997566E181",
              "versionEndExcluding": "02.64"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wago:0852-1328:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "DF26331E-5E32-47F1-A338-0141CA9542DF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wago:0852-1322_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79BD05D2-9F1D-4EBA-AFB5-2F7AB87B2E6C",
              "versionEndExcluding": "02.64"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wago:0852-1322:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F0FF298D-5DB2-4603-B0B7-E9CFBE225B7D"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "info@cert.vde.com"
}