CVE-2025-41753
Status: ReceivedCritical (9.3)—
The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise.
CVSS
- Version: 4.0
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Base score: 9.3
Exploitation probability (EPSS)
FIRST hasn't scored this CVE yet (usual for very recent or rejected CVEs).
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
CWEs
- CWE-22
References
Raw JSON (NVD)
Show
{
"id": "CVE-2025-41753",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "info@cert.vde.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
],
"cvssMetricV40": [
{
"type": "Secondary",
"source": "info@cert.vde.com",
"cvssData": {
"Safety": "NOT_DEFINED",
"version": "4.0",
"Recovery": "NOT_DEFINED",
"baseScore": 9.3,
"Automatable": "NOT_DEFINED",
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"exploitMaturity": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "NONE",
"subIntegrityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"integrityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"vulnAvailabilityImpact": "HIGH",
"availabilityRequirement": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"subConfidentialityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"confidentialityRequirement": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED"
}
}
]
},
"affected": [
{
"source": "info@cert.vde.com",
"affectedData": [
{
"vendor": "WAGO",
"product": "0751-9x01",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0750-811x-xxxx-xxxx",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0750-821x-xxx-xxx",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0762-420x-8000-000x",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0762-430x-8000-000x",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0762-520x-8000-000x",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0762-530x-8000-000x",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0762-620x-8000-000x",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0762-630x-8000-000x",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0752-8303-8000-0002",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0762-340x",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0751-9x01",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9 (70)",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0750-811x-xxxx-xxxx",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9 (70)",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0750-821x-xxx-xxx",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9 (70)",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0762-420x-8000-000x",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9 (70)",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0762-430x-8000-000x",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9 (70)",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0762-520x-8000-000x",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9 (70)",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0762-530x-8000-000x",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9 (70)",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0762-620x-8000-000x",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9 (70)",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0762-630x-8000-000x",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9 (70)",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0752-8303-8000-0002",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9 (70)",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "WAGO",
"product": "0762-340x",
"versions": [
{
"status": "affected",
"version": "1.0.0",
"lessThan": "4.8.9 (70)",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]
}
],
"published": "2026-10-01T07:16:32.473",
"references": [
{
"url": "https://www.certvde.com/en/advisories/VDE-2025-102/",
"source": "info@cert.vde.com"
}
],
"vulnStatus": "Received",
"weaknesses": [
{
"type": "Primary",
"source": "info@cert.vde.com",
"description": [
{
"lang": "en",
"value": "CWE-22"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The object name of a dynamically created BACnet File Object is interpreted as a file path without sufficient validation. Because relative paths are not limited to the intended directory, an unauthenticated remote attacker can traverse outside of it and read or overwrite arbitrary files on the device, which may lead to full system compromise."
}
],
"lastModified": "2026-10-01T07:16:32.473",
"sourceIdentifier": "info@cert.vde.com"
}