CVE-2025-41651: Weidmueller: Missing Authentication Vulnerability in Industrial Ethernet Switches

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-27 · updated 2026-06-17
Weakness: CWE-306

Description

Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upload or download of configuration files and leading to full system compromise.

Affected products

Weidmueller IE-SW-PL10M-3GT-7TX: before 3.3.34 — fixed in 3.3.34
Weidmueller IE-SW-PL10MT-3GT-7TX: before 3.3.34 — fixed in 3.3.34
Weidmueller IE-SW-PL16M-16TX: before 3.4.32 — fixed in 3.4.32
Weidmueller IE-SW-PL16MT-16TX: before 3.4.32 — fixed in 3.4.32
Weidmueller IE-SW-PL18M-2GC-16TX: before 3.4.40 — fixed in 3.4.40
Weidmueller IE-SW-PL18MT-2GC-16TX: before 3.4.40 — fixed in 3.4.40
Weidmueller IE-SW-VL05M-5TX: before 3.6.32 — fixed in 3.6.32
Weidmueller IE-SW-VL05MT-5TX: before 3.6.32 — fixed in 3.6.32
Weidmueller IE-SW-VL08MT-5TX-1SC-2SCS: before 3.5.36 — fixed in 3.5.36
Weidmueller IE-SW-VL08MT-6TX-2SC: before 3.5.36 — fixed in 3.5.36
Weidmueller IE-SW-VL08MT-6TX-2SCS: before 3.5.36 — fixed in 3.5.36
Weidmueller IE-SW-VL08MT-6TX-2ST: before 3.5.36 — fixed in 3.5.36
Weidmueller IE-SW-VL08MT-8TX: before 3.5.36 — fixed in 3.5.36

How to fix

Upgrade to a fixed version: Weidmueller IE-SW-PL10M-3GT-7TX 3.3.34; Weidmueller IE-SW-PL10MT-3GT-7TX 3.3.34; Weidmueller IE-SW-PL16M-16TX 3.4.32; Weidmueller IE-SW-PL16MT-16TX 3.4.32; Weidmueller IE-SW-PL18M-2GC-16TX 3.4.40; Weidmueller IE-SW-PL18MT-2GC-16TX 3.4.40; Weidmueller IE-SW-VL05M-5TX 3.6.32; Weidmueller IE-SW-VL05MT-5TX 3.6.32; Weidmueller IE-SW-VL08MT-5TX-1SC-2SCS 3.5.36; Weidmueller IE-SW-VL08MT-6TX-2SC 3.5.36; Weidmueller IE-SW-VL08MT-6TX-2SCS 3.5.36; Weidmueller IE-SW-VL08MT-6TX-2ST 3.5.36. Check the vendor advisory for mitigations.

References

https://certvde.com/en/advisories/VDE-2025-044/

Get alerted when CVE-2025-41651 or the next vulnerability affects your stack