CVE-2025-41652: Weidmueller: Authentication Bypass Vulnerability in Industrial Ethernet Switches

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-05-27 · updated 2026-06-17
Weakness: CWE-328

Description

The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker could exploit this weakness by performing brute-force attacks to guess valid credentials or by using MD5 collision techniques to forge authentication hashes, potentially compromising the device.

Affected products

Weidmueller IE-SW-PL10M-3GT-7TX: before 3.3.34 — fixed in 3.3.34
Weidmueller IE-SW-PL10MT-3GT-7TX: before 3.3.34 — fixed in 3.3.34
Weidmueller IE-SW-PL16M-16TX: before 3.4.32 — fixed in 3.4.32
Weidmueller IE-SW-PL16MT-16TX: before 3.4.32 — fixed in 3.4.32
Weidmueller IE-SW-PL18M-2GC-16TX: before 3.4.40 — fixed in 3.4.40
Weidmueller IE-SW-PL18MT-2GC-16TX: before 3.4.40 — fixed in 3.4.40
Weidmueller IE-SW-VL05M-5TX: before 3.6.32 — fixed in 3.6.32
Weidmueller IE-SW-VL05MT-5TX: before 3.6.32 — fixed in 3.6.32
Weidmueller IE-SW-VL08MT-5TX-1SC-2SCS: before 3.5.36 — fixed in 3.5.36
Weidmueller IE-SW-VL08MT-6TX-2SC: before 3.5.36 — fixed in 3.5.36
Weidmueller IE-SW-VL08MT-6TX-2SCS: before 3.5.36 — fixed in 3.5.36
Weidmueller IE-SW-VL08MT-6TX-2ST: before 3.5.36 — fixed in 3.5.36
Weidmueller IE-SW-VL08MT-8TX: before 3.6.32 — fixed in 3.6.32

How to fix

Upgrade to a fixed version: Weidmueller IE-SW-PL10M-3GT-7TX 3.3.34; Weidmueller IE-SW-PL10MT-3GT-7TX 3.3.34; Weidmueller IE-SW-PL16M-16TX 3.4.32; Weidmueller IE-SW-PL16MT-16TX 3.4.32; Weidmueller IE-SW-PL18M-2GC-16TX 3.4.40; Weidmueller IE-SW-PL18MT-2GC-16TX 3.4.40; Weidmueller IE-SW-VL05M-5TX 3.6.32; Weidmueller IE-SW-VL05MT-5TX 3.6.32; Weidmueller IE-SW-VL08MT-5TX-1SC-2SCS 3.5.36; Weidmueller IE-SW-VL08MT-6TX-2SC 3.5.36; Weidmueller IE-SW-VL08MT-6TX-2SCS 3.5.36; Weidmueller IE-SW-VL08MT-6TX-2ST 3.5.36. Check the vendor advisory for mitigations.

References

https://certvde.com/en/advisories/VDE-2025-044/

Get alerted when CVE-2025-41652 or the next vulnerability affects your stack