What’s Vulnerable › Vulnerabilities

CVE-2025-41709: Command injection in power analyzer via Modbus-TCP and Modbus-RTU

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-10 · updated 2026-06-17
• Weakness: CWE-78

Description

An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write access on the affected device.

Affected products

• Janitza UMG 96RM-E 230V(5222062): through 3.13
• Janitza UMG 96RM-E 24V(5222063): through 3.13
• Weidmueller ENERGY METER 750-230 (2540910000): through 3.13
• Weidmueller ENERGY METER 750-24 (2540900000): through 3.13

References

• https://certvde.com/en/advisories/VDE-2025-079/
• https://certvde.com/en/advisories/VDE-2025-096/
• https://janitza.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-079.json
• https://weidmueller.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-096.json

Get alerted when CVE-2025-41709 or the next vulnerability affects your stack