Murrelektronik: Cleartext Transmission of Sensitive Information in IMPACT67 Pro
The embedded web interface of the MURRELEKTRONIK IMPACT67 Pro PN DIO8 IOL8 transmits login credentials over unencrypted HTTP using a GET request. The device does not offer HTTPS/TLS support, exposing user credentials to passive interception by any attacker on the same network.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-41718US | —OT erhöht | — | ||
A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and access the Web-UI. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- VDE-2025-091: Murrelektronik: Cleartext Transmission of Sensitive Information in IMPACT67 Pro - HTMLself
- CERT@VDE Security Advisories for Murrelektronikexternal
- VDE-2025-091: Murrelektronik: Cleartext Transmission of Sensitive Information in IMPACT67 Pro - CSAFself
- Murrelektronik Product Security Incident Response (PSIRT) Teamexternal
Behebungen (8)
- Mitigation54620
Murrelektronik recommends: * Deactivating the Webserver will prevent any data from being sent unencrypted. More information on how to disable the webserver can be found in the manual. * Deactivating all unused network ports in the unit will prevent data sniffing. * Segmenting the network strictly helps to minimize unauthorized access to network traffic. If the webserver must stay activated, this is recommended to reduce the security breaches impact. * Advise users of the system to not use personal data or standard passwords for the webserver accounts. This helps to prevent personal data leakage.
- Mitigation54630
Murrelektronik recommends: * Deactivating the Webserver will prevent any data from being sent unencrypted. More information on how to disable the webserver can be found in the manual. * Deactivating all unused network ports in the unit will prevent data sniffing. * Segmenting the network strictly helps to minimize unauthorized access to network traffic. If the webserver must stay activated, this is recommended to reduce the security breaches impact. * Advise users of the system to not use personal data or standard passwords for the webserver accounts. This helps to prevent personal data leakage.
- Mitigation54631
Murrelektronik recommends: * Deactivating the Webserver will prevent any data from being sent unencrypted. More information on how to disable the webserver can be found in the manual. * Deactivating all unused network ports in the unit will prevent data sniffing. * Segmenting the network strictly helps to minimize unauthorized access to network traffic. If the webserver must stay activated, this is recommended to reduce the security breaches impact. * Advise users of the system to not use personal data or standard passwords for the webserver accounts. This helps to prevent personal data leakage.
- Mitigation54632
Murrelektronik recommends: * Deactivating the Webserver will prevent any data from being sent unencrypted. More information on how to disable the webserver can be found in the manual. * Deactivating all unused network ports in the unit will prevent data sniffing. * Segmenting the network strictly helps to minimize unauthorized access to network traffic. If the webserver must stay activated, this is recommended to reduce the security breaches impact. * Advise users of the system to not use personal data or standard passwords for the webserver accounts. This helps to prevent personal data leakage.
- Kein Fix verfügbar54620
There is no fix available in the current versions. A permanent solution is planned to be implemented in the future.
- Kein Fix verfügbar54630
There is no fix available in the current versions. A permanent solution is planned to be implemented in the future.
- Kein Fix verfügbar54631
There is no fix available in the current versions. A permanent solution is planned to be implemented in the future.
- Kein Fix verfügbar54632
There is no fix available in the current versions. A permanent solution is planned to be implemented in the future.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan