CVE-2025-41656

criticalpriority · track · 14OT risk · elevatedEPSS 0.124 · 96 %ileexploit · PoCDEEURU
grimoire priorityP1 · Urgent
Exploitable?
Public exploit
1 exploit · PoC
Likely / severe?
12.4% (96th) EPSS
CVSS 10 · critical
Is it mine?
3 products
Check your exposure
Who says so?
4 sources
cnnvd · enisa_euvd · fstec_bdu · pilz_psirt

EPSS · scored 2026-10-22

An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by default.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedFirmware Bullseye <=2024-08 installed on IndustrialPI 4pilz_psirt

    Consult our PDF with remediations which you can find under [www.pilz.com/downloads](https://www.pilz.com/search#currentPage=1&SEARCH=Security%20Advis.%20IndustrialPI%20Remediat.). In order to activate the authentication as described in the PDF, you have to have the Node-RED service enabled via the web application.

  • MitigationFirmware Bullseye <=2024-08 installed on IndustrialPI 4pilz_psirt

    Limit network access to the IndustrialPI by using a firewall or similar measures.

02

cvss

Technical severity, 0–10. One row per scoring source.

10.0
010

base score 0–10 · higher = more severe · hover a vector to decode

v3.110criticalAV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU
v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU
v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · info@cert.vde.comexploitability 3.9 · impact 6
v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · Pilz PSIRT DE
v3.19.4criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-306USCWE-306USCWE-306US
05

exploits (1)

Public proof-of-concept and weaponised exploit code.

06

affected products (3)

Products and version ranges known to be affected.

07

advisories (1)

Vendor and ecosystem advisories describing this.

  • PPSA-2025-002Pilz: Missing Authentication in Node-RED integration2025-07-01csaf · pilz_psirtDE

    Authentication is not configured by default for the Node-RED server on the Pilz industrial PC IndustrialPI. An unauthenticated remote attacker has full access to the Node-RED server and can run arbitrary operating system commands on the underlying operating system with privileged rights.

08

also known as (5)

Other names and identifiers for this entity.

09

sources

Which sources assert this record, and when.

cnnvdenisa_euvdfstec_bdupilz_psirtNVDCVE.orgMITRE
published 2025-07-01modified 2026-06-17
10

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan