CVE-2025-41731

highEPSS 0.001 · 3 %ileDEEURU

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.14% (3rd) EPSS

CVSS 7.4 · high

Is it mine?

12 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · jumo_psirt

EPSS · scored 2026-10-20

A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the debug interface is still enabled.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedjumo_psirt
Update the affected products to version 9.0.2.5.
Mitigationjumo_psirt
Disable the debug interface to prevent unauthorized root-access to the ssh Interface. The debug interface of the ssh is deactivated after rebooting the system.

cvss

Technical severity, 0–10. One row per scoring source.

7.4

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–7.4

v3.17.4highAV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.17.4highCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.17.4highCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · info@cert.vde.comexploitability 1.4 · impact 5.9

v3.16.8mediumCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.17.4highCVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · JUMO PSIRT

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-338USCWE-338USCWE-338US

affected products (12)

Products and version ranges known to be affected.

Jumo variTRON3000.0.0.0 → 9.0.2.5enisa_euvdEU
Jumo variTRON5000.0.0.0 → 9.0.2.5enisa_euvdEU
Jumo variTRON500 touch0.0.0.0 → 9.0.2.5enisa_euvdEU
JUMO GmbH & Co. KG variTRON300≤ 9.0.2.5fstec_bduRU
JUMO GmbH & Co. KG variTRON500≤ 9.0.2.5fstec_bduRU
JUMO GmbH & Co. KG variTRON500 touch≤ 9.0.2.5fstec_bduRU
Firmware 9.0.2.5. installed on variTRON300all versionsfixedjumo_psirtDE
Firmware 9.0.2.5. installed on variTRON500all versionsfixedjumo_psirtDE
Firmware 9.0.2.5. installed on variTRON500 touchall versionsfixedjumo_psirtDE
Firmware <9.0.2.5. installed on variTRON300all versionsjumo_psirtDE
Firmware <9.0.2.5. installed on variTRON500all versionsjumo_psirtDE
Firmware <9.0.2.5. installed on variTRON500 touchall versionsjumo_psirtDE

advisories (1)

Vendor and ecosystem advisories describing this.

VDE-2025-086Jumo: Predictable debug-interface password in variTRON series2025-11-10csaf · jumo_psirtDE
A vulnerability was identified in the variTRON password generation algorithm of the debug-interface. The PRNG is initialized with the current Unix Timestamp, thus the resulting password is predictable. With the password root-access to the UART and ssh Interface can be gained. The impact is limited, since the debug-interface has to be actively enabled by an authorized user and will be deactivated automatically after the next reboot of the device.

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu jumo_psirt NVD CVE.org MITRE

published 2025-11-10modified 2026-10-18

references (3)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan