VDB
CVE-2025-41659
CVE-2025-41659
PUBLISHED
CVSS 8.300000190734863 HIGH
A vulnerability in the runtime system allows low-privileged remote attackers to access the PKI folder via CODESYS protocol, enabling them to read and write certificates and keys. This exposes sensitive cryptographic data and allows unauthorized certificates to be trusted. However, all services remain available, only certificate based encryption and signing features are concerned. The issue affects systems using the optional CmpOpenSSL component for cryptographic operations.
EPSS 0.14% · 33.6th percentile
Risk Scores
CVSS v3.1
8.300000190734863
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L/E:F/RL:O/RC:C
EPSS Score
0.14%
33.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| ABB | ABB AC500 V3 <3.9.0 |
Timeline
- Aug 3, 2025 CVE Published
- Aug 4, 2025 EPSS Score
- Aug 4, 2025 Coalition ESS Score
- Aug 4, 2025 PoC Published
- Aug 4, 2025 CVE Updated
- Aug 13, 2025 EPSS Score
- Aug 21, 2025 EPSS Score
- Aug 22, 2025 Coalition ESS Score
- Aug 26, 2025 Coalition ESS Score
- Aug 30, 2025 EPSS Score
- Sep 7, 2025 EPSS Score
- Sep 16, 2025 EPSS Score
References
- https://psirt.abb.com/csaf/2026/3adr011524.json advisory
- https://search.abb.com/library/Download.aspx?DocumentID=3ADR011524&LanguageCode=en&DocumentPartId=&Action=Launch advisory
- https://api-www.codesys.com/fileadmin/user_upload/CODESYS_Group/Ecosystem/Up-to-Date/Security/Security-Advisories/Advisory2025-05_VIS-5003_.pdf advisory
- https://api-www.codesys.com/fileadmin/user_upload/CODESYS_Group/Ecosystem/Up-to-Date/Security/Security-Advisories/Advisory2025-07_CDS-93244.pdf advisory
- https://api-www.codesys.com/fileadmin/user_upload/CODESYS_Group/Ecosystem/Up-to-Date/Security/Security-Advisories/Advisory2025-08_CDS-94690.pdf advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-41659 advisory