CVE-2025-41647

mediumpriority · track · 0OT risk · elevatedEPSS 0.001 · 1 %ileDEEU
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.10% (1st) EPSS
CVSS 5.5 · medium
Is it mine?
5 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · lenze_psirt

EPSS · scored 2026-10-22

A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the password being displayed in plain text under special conditions.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedPLC Designer V4lenze_psirt

    This vulnerability has been fixed in the new version. All users are strongly recommended to use the new version 4.0.1.

  • MitigationPLC Designer V4lenze_psirt

    The PLC Designer V4 tool is designed and developed for use in closed and protected security zones. Lenze therefore strongly recommends that this tool is only used in familiar areas. As this security vulnerability relates to a plain text display of an entered password and not to the password method saved afterwards, it is recommended as mitigation to protect the viewing area of the tool from strangers when entering it in order to prevent the shoulder surfing attack method.

02

cvss

Technical severity, 0–10. One row per scoring source.

5.5
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU
v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · info@cert.vde.comexploitability 1.8 · impact 3.6
v3.15.5mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · Lenze PSIRT DE
v3.15.1mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-312USCWE-312US
05

affected products (5)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • VDE-2025-043Lenze: PLC Designer V4 with insecure storage of sensitive information2025-06-25csaf · lenze_psirtDE

    A security vulnerability was discovered in the PLC Designer V4 in the version 4.0.0 where the programmer of a Controller can set a password for the connected device. Here it is possible in an interface of the PLC Designer V4 for the programmer to enter a password for the Device. There is a special constellation where the password entered appears in plain text. Only the display in the tool is affected and not the management of the password on the device. This vulnerability of PLC Designer V4 only occurs in combination with the devices c430 controller, c520 controller and c550 controller and not in combination with other devices, as this functionality is only used here. It is generally recommended that all users update to 4.0.1, but especially all users who operate PLC Designer V4 in combination with the controllers mentioned.

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdlenze_psirtNVDCVE.orgMITRE
published 2025-06-25modified 2026-06-17
09

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan