CVE-2025-41708

highpriority · track · 0OT risk · elevatedEPSS 0.002 · 14 %ileDEEU

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.24% (14th) EPSS

CVSS 7.4 · high

Is it mine?

10 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · bender_psirt

EPSS · scored 2026-10-28

Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

Mitigationbender_psirt
Enable use of HTTPS in the charge controller configuration Web UI settings>system>https

cvss

Technical severity, 0–10. One row per scoring source.

7.4

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–7.4

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · ENISA EU

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · info@cert.vde.comexploitability 2.2 · impact 5.2

v3.17.4highCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Nsecondary · Bender PSIRT DE

v3.16.8mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-319USCWE-319US

affected products (10)

Products and version ranges known to be affected.

Firmware vers:all/* installed on CC612all versionsbender_psirtDE
Firmware vers:all/* installed on CC613all versionsbender_psirtDE
Firmware vers:all/* installed on ICC13xxall versionsbender_psirtDE
Firmware vers:all/* installed on ICC15xxall versionsbender_psirtDE
Firmware vers:all/* installed on ICC16xxall versionsbender_psirtDE
Bender CC612≤ 0.0.0 ≤all versionsenisa_euvdEU
Bender CC613≤ 0.0.0 ≤all versionsenisa_euvdEU
Bender ICC13xx≤ 0.0.0 ≤all versionsenisa_euvdEU
Bender ICC15xx≤ 0.0.0 ≤all versionsenisa_euvdEU
Bender ICC16xx≤ 0.0.0 ≤all versionsenisa_euvdEU

advisories (1)

Vendor and ecosystem advisories describing this.

VDE-2025-084Bender Charge Controller Vulnerability - Unsecure Communication2025-09-08csaf · bender_psirtDE
Bender is publishing this advisory to inform customers about a security vulnerability in the Charge Controller product families. Bender has analyzed the weakness and determined that the electrical safety of the devices is not affected. Bender considers the weakness to be of high risk and it should be patched immediately.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd bender_psirt NVD CVE.org MITRE

published 2025-09-08modified 2026-10-18

references (5)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan