CVE-2025-41713
published 2025-09-15CVE-2025-41713: During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating…
PriorityP340medium6.5CVSS 3.1
AVNACLPRNUINSUCLINAL
EPSS
0.35%
26.7th percentile
During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating in an undefined state until a CPU-induced reset allows proper configuration.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wago | cc100_0751-9301 | < HW | HW |
| wago | cc100_0751-9301_k000-0005 | < HW | HW |
| wago | cc100_0751-9401 | < HW | HW |
| wago | cc100_0751-9402 | < HW | HW |
| wago | cc100_0751-9402_0000-0001 | < HW | HW |
| wago | cc100_0751-9403 | < HW | HW |
| wago | edge_controller_0752-8303_8000-0002 | < HW | HW |
| wago | edge_controller_0752-8303_8000-0002_hw_rev_32500 | < 04.08.05 | 04.08.05 |
| wago | tp600_0762-4101 | < HW | HW |
| wago | tp600_0762-4102 | < HW | HW |
| wago | tp600_0762-4104 | < HW | HW |
| wago | tp600_0762-4201_8000-0001 | < HW | HW |
| wago | tp600_0762-4201_8000-0002 | < HW | HW |
| wago | tp600_0762-4301_8000-0002 | < HW | HW |
| wago | tp600_0762-4302_8000-0002 | < HW | HW |
| wago | tp600_0762-4303_8000-0002 | < HW | HW |
| wago | tp600_0762-4304_8000-0002 | < HW | HW |
| wago | tp600_0762-4305_8000-0002 | < HW | HW |
| wago | tp600_0762-4306_8000-0001 | < HW | HW |
| wago | tp600_0762-4306_8000-0002 | < HW | HW |
| wago | tp600_0762-5201_8000-0001 | < HW | HW |
| wago | tp600_0762-5203_8000-0001 | < HW | HW |
| wago | tp600_0762-5204_8000-0001 | < HW | HW |
| wago | tp600_0762-5205_8000-0001 | < HW | HW |
| wago | tp600_0762-5206_8000-0001 | < HW | HW |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
cisa9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4x6r-qc3x-j39x: During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch o
ghsa_unreviewed·2025-09-15
CVE-2025-41713 [MEDIUM] CWE-1188 GHSA-4x6r-qc3x-j39x: During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch o
During a short time frame while the device is booting an unauthenticated remote attacker can send traffic to unauthorized networks due to the switch operating in an undefined state until a CPU-induced reset allows proper configuration.
CISA
Mitel MiCollab Path Traversal Vulnerability
cisa·2025-01-07·CVSS 9.1
CVE-2024-41713 [CRITICAL] CWE-22 Mitel MiCollab Path Traversal Vulnerability
Vulnerability: Mitel MiCollab Path Traversal Vulnerability
Affected: Mitel MiCollab
Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029 ; https://nvd.nist.gov/vuln/detail/CVE-2024-41713
Remediation Due Date: 2025-01-28
CISA
Mitel MiCollab Path Traversal Vulnerability
cisa·2025-01-07·CVSS 9.1
CVE-2024-55550 [CRITICAL] CWE-22 Mitel MiCollab Path Traversal Vulnerability
Vulnerability: Mitel MiCollab Path Traversal Vulnerability
Affected: Mitel MiCollab
Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029 ; https://nvd.nist.gov/vuln/detail/CVE-2024-55550
Remediation Due Date: 2025-01-28
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-09-15
Published