CVE-2025-41705 - OpenCVE

An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Phoenix Contact	Quint4-ups/24dc/24dc/10/eip Quint4-ups/24dc/24dc/20/eip Quint4-ups/24dc/24dc/40/eip Quint4-ups/24dc/24dc/5/eip

No data.

No data.

References

Link	Providers
http://seclists.org/fulldisclosure/2025/Oct/12
https://certvde.com/de/advisories/VDE-2025-072

History

Mon, 03 Nov 2025 18:30:00 +0000

Type	Values Removed	Values Added
References		http://seclists.org/fulldisclosure/2025/Oct/12

Tue, 21 Oct 2025 13:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Phoenix Contact Phoenix Contact quint4-ups/24dc/24dc/10/eip Phoenix Contact quint4-ups/24dc/24dc/20/eip Phoenix Contact quint4-ups/24dc/24dc/40/eip Phoenix Contact quint4-ups/24dc/24dc/5/eip
Vendors & Products		Phoenix Contact Phoenix Contact quint4-ups/24dc/24dc/10/eip Phoenix Contact quint4-ups/24dc/24dc/20/eip Phoenix Contact quint4-ups/24dc/24dc/40/eip Phoenix Contact quint4-ups/24dc/24dc/5/eip

Tue, 14 Oct 2025 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 14 Oct 2025 08:15:00 +0000

Type	Values Removed	Values Added
Description		An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.
Title		Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials
Weaknesses		CWE-523
References		https://certvde.com/de/advisories/VDE-2025-072
Metrics		cvssV3_1 `{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2025-10-14T08:05:43.031Z

Updated: 2025-11-03T17:44:47.442Z

Reserved: 2025-04-16T11:17:48.310Z

Link: CVE-2025-41705

Vulnrichment

Updated: 2025-11-03T17:44:47.442Z

NVD

Status : Awaiting Analysis

Published: 2025-10-14T08:15:35.650

Modified: 2025-11-03T18:16:53.680

Link: CVE-2025-41705

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-41705", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2025-04-16T11:17:48.310Z", "datePublished": "2025-10-14T08:05:43.031Z", "dateUpdated": "2025-11-03T17:44:47.442Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "QUINT4-UPS/24DC/24DC/5/EIP", "vendor": "Phoenix Contact", "versions": [{"lessThan": "VC:07", "status": "affected", "version": "VC:00", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "QUINT4-UPS/24DC/24DC/10/EIP", "vendor": "Phoenix Contact", "versions": [{"lessThan": "VC:07", "status": "affected", "version": "VC:00", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "QUINT4-UPS/24DC/24DC/20/EIP", "vendor": "Phoenix Contact", "versions": [{"lessThan": "VC:07", "status": "affected", "version": "VC:00", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "QUINT4-UPS/24DC/24DC/40/EIP", "vendor": "Phoenix Contact", "versions": [{"lessThan": "VC:07", "status": "affected", "version": "VC:00", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.<br>"}], "value": "An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-523", "description": "CWE-523 Unprotected Transport of Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-10-14T08:06:21.805Z"}, "references": [{"url": "https://certvde.com/de/advisories/VDE-2025-072"}], "source": {"advisory": "VDE-2025-072", "defect": ["CERT@VDE#641835"], "discovery": "UNKNOWN"}, "title": "Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-14T18:39:39.309928Z", "id": "CVE-2025-41705", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T18:39:54.898Z"}}, {"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2025/Oct/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:44:47.442Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://seclists.org/fulldisclosure/2025/Oct/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T17:44:47.442Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-41705", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-14T18:39:39.309928Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-14T18:39:42.762Z"}}], "cna": {"title": "Phoenix Contact: WebSocket Message Interception Leaks Webfrontend Credentials", "source": {"defect": ["CERT@VDE#641835"], "advisory": "VDE-2025-072", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "D. Blagojevic, S. Dietz, F. Koroknai, T. Weber from CyberDanube Security Research"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Phoenix Contact", "product": "QUINT4-UPS/24DC/24DC/5/EIP", "versions": [{"status": "affected", "version": "VC:00", "lessThan": "VC:07", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Phoenix Contact", "product": "QUINT4-UPS/24DC/24DC/10/EIP", "versions": [{"status": "affected", "version": "VC:00", "lessThan": "VC:07", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Phoenix Contact", "product": "QUINT4-UPS/24DC/24DC/20/EIP", "versions": [{"status": "affected", "version": "VC:00", "lessThan": "VC:07", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Phoenix Contact", "product": "QUINT4-UPS/24DC/24DC/40/EIP", "versions": [{"status": "affected", "version": "VC:00", "lessThan": "VC:07", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://certvde.com/de/advisories/VDE-2025-072"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.", "supportingMedia": [{"type": "text/html", "value": "An unauthenticated remote attacker (MITM) can intercept the websocket messages to gain access to the login credentials for the Webfrontend.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-523", "description": "CWE-523 Unprotected Transport of Credentials"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-10-14T08:06:21.805Z"}}}, "cveMetadata": {"cveId": "CVE-2025-41705", "state": "PUBLISHED", "dateUpdated": "2025-11-03T17:44:47.442Z", "dateReserved": "2025-04-16T11:17:48.310Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2025-10-14T08:05:43.031Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.2"}