Janitza PSIRT (CSAF)
advisoryDEjanitza_psirt
Janitza PSIRT CSAF 2.0 advisories (hosted by CERT@VDE).
01
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
02
Produkt-Aussagen (8)
Betroffene Produkte und Versionsbereiche.
- Firmware 3.13 installed on UMG 96RM-E 230V
- Firmware 3.13 installed on UMG 96RM-E 24V
- Firmware 3.14 installed on UMG 96RM-E 230V
- Firmware 3.14 installed on UMG 96RM-E 24V
- Firmware 3.54 installed on UMG 96-PA
- Firmware 3.54 installed on UMG 96-PA-MID+
- Firmware <3.54 installed on UMG 96-PA
- Firmware <3.54 installed on UMG 96-PA-MID+
03
CVE-Verknüpfungen (5)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2025-41712US | — | — | ||
An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive information on the device. This is a result of incorrect permissi… | ||||
| CVE-2025-41711US | —OT erhöht | — | ||
An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access. | ||||
| CVE-2025-41710US | —OT erhöht | — | ||
An unauthenticated remote attacker may use hardcodes credentials to get access to the previously activated FTP Server with limited read and write privileges. | ||||
| CVE-2025-41709US | — | — | ||
An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write access on the affected device. | ||||
| CVE-2025-41729US | — | — | ||
An unauthenticated remote attacker can send a specially crafted Modbus read command to the device which leads to a denial of service. | ||||