CVE-2025-41718

highpriority · track · 0OT risk · elevatedEPSS 0.003 · 17 %ileDEEU
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
0.26% (17th) EPSS
CVSS 7.5 · high
Is it mine?
8 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · murrelektronik_psirt

EPSS · scored 2026-10-23

A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and access the Web-UI.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

No vendor fix yet; a mitigation is available.

  • Mitigation54620murrelektronik_psirt

    Murrelektronik recommends: * Deactivating the Webserver will prevent any data from being sent unencrypted. More information on how to disable the webserver can be found in the manual. * Deactivating all unused network ports in the unit will prevent data sniffing. * Segmenting the network strictly helps to minimize unauthorized access to network traffic. If the webserver must stay activated, this is recommended to reduce the security breaches impact. * Advise users of the system to not use personal data or standard passwords for the webserver accounts. This helps to prevent personal data leakage.

  • Mitigation54630murrelektronik_psirt

    Murrelektronik recommends: * Deactivating the Webserver will prevent any data from being sent unencrypted. More information on how to disable the webserver can be found in the manual. * Deactivating all unused network ports in the unit will prevent data sniffing. * Segmenting the network strictly helps to minimize unauthorized access to network traffic. If the webserver must stay activated, this is recommended to reduce the security breaches impact. * Advise users of the system to not use personal data or standard passwords for the webserver accounts. This helps to prevent personal data leakage.

  • Mitigation54631murrelektronik_psirt

    Murrelektronik recommends: * Deactivating the Webserver will prevent any data from being sent unencrypted. More information on how to disable the webserver can be found in the manual. * Deactivating all unused network ports in the unit will prevent data sniffing. * Segmenting the network strictly helps to minimize unauthorized access to network traffic. If the webserver must stay activated, this is recommended to reduce the security breaches impact. * Advise users of the system to not use personal data or standard passwords for the webserver accounts. This helps to prevent personal data leakage.

  • Mitigation54632murrelektronik_psirt

    Murrelektronik recommends: * Deactivating the Webserver will prevent any data from being sent unencrypted. More information on how to disable the webserver can be found in the manual. * Deactivating all unused network ports in the unit will prevent data sniffing. * Segmenting the network strictly helps to minimize unauthorized access to network traffic. If the webserver must stay activated, this is recommended to reduce the security breaches impact. * Advise users of the system to not use personal data or standard passwords for the webserver accounts. This helps to prevent personal data leakage.

  • No fix available54620murrelektronik_psirt

    There is no fix available in the current versions. A permanent solution is planned to be implemented in the future.

  • No fix available54630murrelektronik_psirt

    There is no fix available in the current versions. A permanent solution is planned to be implemented in the future.

  • No fix available54631murrelektronik_psirt

    There is no fix available in the current versions. A permanent solution is planned to be implemented in the future.

  • No fix available54632murrelektronik_psirt

    There is no fix available in the current versions. A permanent solution is planned to be implemented in the future.

02

cvss

Technical severity, 0–10. One row per scoring source.

7.5
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.9–7.5

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · ENISA EU
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · info@cert.vde.comexploitability 3.9 · impact 3.6
v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:Usecondary · CVSS-BT (t0sche)
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Nsecondary · Murrelektronik PSIRT
03

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS
04

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-319USCWE-319US
05

affected products (8)

Products and version ranges known to be affected.

06

advisories (1)

Vendor and ecosystem advisories describing this.

  • VDE-2025-091Murrelektronik: Cleartext Transmission of Sensitive Information in IMPACT67 Pro2025-10-14csaf · murrelektronik_psirtDE

    The embedded web interface of the MURRELEKTRONIK IMPACT67 Pro PN DIO8 IOL8 transmits login credentials over unencrypted HTTP using a GET request. The device does not offer HTTPS/TLS support, exposing user credentials to passive interception by any attacker on the same network.

07

also known as (3)

Other names and identifiers for this entity.

08

sources

Which sources assert this record, and when.

cnnvdenisa_euvdmurrelektronik_psirtNVDCVE.orgMITRE
published 2025-10-14modified 2026-10-18
09

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan