CVE-2025-3496

highpriority · track · 0EPSS 0.006 · 47 %ileDEEU

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.58% (47th) EPSS

CVSS 7.5 · high

Is it mine?

20 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · auma_psirt

EPSS · scored 2026-10-23

An unauthenticated remote attacker can cause a buffer overflow which could lead to unexpected behaviour or DoS via Bluetooth or RS-232 interface.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

Mitigationauma_psirt
It is recommended to update to a new version, with which the error can no longer occur.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · info@cert.vde.comexploitability 3.9 · impact 3.6

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · AUMA PSIRT

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-120USCWE-120US

affected products (20)

Products and version ranges known to be affected.

Firmware 01-01.09.00 installed on TIGRONall versionsfixedauma_psirtDE
Firmware 01-01.10.00 installed on PROFOXall versionsfixedauma_psirtDE
Firmware 01.02.00 installed on MEC 03.01all versionsfixedauma_psirtDE
Firmware 02-01.01.00 installed on TIGRON SILall versionsfixedauma_psirtDE
Firmware 03.05.01 installed on SGx/SVxall versionsfixedauma_psirtDE
Firmware 06.09.04 installed on AC1.2all versionsfixedauma_psirtDE
Firmware <01-01.09.00 installed on TIGRONall versionsauma_psirtDE
Firmware <01-01.10.00 installed on PROFOXall versionsauma_psirtDE
Firmware <01.02.00 installed on MEC 03.01all versionsauma_psirtDE
Firmware <02-01.01.00 installed on TIGRON SILall versionsauma_psirtDE
Firmware >03.00.00<03.05.01 installed on SGx/SVxall versionsauma_psirtDE
Firmware >06.00.00<06.09.04 installed on AC1.2all versionsauma_psirtDE
AC1.2>06.00.00 → 06.09.04enisa_euvdEU
AC1.206.00.00 → 06.09.04enisa_euvdEU
MEC 03.010 → 01.02.00enisa_euvdEU
PROFOX0 → 01-01.10.00enisa_euvdEU
SGx/SVx>03.00.00 → 03.05.01enisa_euvdEU
SGx/SVx03.00.00 → 03.05.01enisa_euvdEU
TIGRON0 → 01-01.09.00enisa_euvdEU
TIGRON SIL0 → 02-01.01.00enisa_euvdEU

advisories (1)

Vendor and ecosystem advisories describing this.

VDE-2025-026AUMA Riester: Buffer overflow in service telegram2025-05-12csaf · auma_psirtDE
Sending too much data in the service telegram of AUMA actuators leads to a buffer overflow in the actuator controls. Depending on the actuator, the service telegram is transmitted either via Bluetooth or RS232

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd auma_psirt NVD CVE.org MITRE

published 2025-05-12modified 2026-06-17

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan