« Volver al listado

CVE-2025-41732

Estado: AnalizadaCrítica (9.8)—

An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vector CVSS N/N/N: acceso remoto sin autenticación ni interacción. Buffer overflow (CWE-121, CWE-787) en sscanf permite RCE y compromiso total del dispositivo; impactos: ejecución arbitraria de código y escalada de privilegios implícita.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account ManagementExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate SoftwareVulnerability Scanning

Tecnologías afectadas (2)

Wago — 0852-1322 FirmwareWago — 0852-1328 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-41732",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-41732",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-18T20:35:59.495336Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "WAGO",
          "product": "Indsutrial-Managed-Switches",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "02.64",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-12-10T11:15:48.217",
  "references": [
    {
      "url": "https://certvde.com/de/advisories/VDE-2025-095",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "info@cert.vde.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-121"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise."
    },
    {
      "lang": "es",
      "value": "Un atacante remoto no autenticado puede explotar llamadas sscanf inseguras dentro de la función check_cookie() para escribir datos arbitrarios en búferes de pila de tamaño fijo, lo que lleva a un compromiso total del dispositivo."
    }
  ],
  "lastModified": "2026-09-25T23:10:00.463",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wago:0852-1328_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "402B0083-E354-4B25-82E4-1A997566E181",
              "versionEndExcluding": "02.64"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wago:0852-1328:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "DF26331E-5E32-47F1-A338-0141CA9542DF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:wago:0852-1322_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "79BD05D2-9F1D-4EBA-AFB5-2F7AB87B2E6C",
              "versionEndExcluding": "02.64"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:wago:0852-1322:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F0FF298D-5DB2-4603-B0B7-E9CFBE225B7D"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "info@cert.vde.com"
}