CVE-2025-41709 | An unauthenticated remote attacker can perform a command inj… | CVSS 9.8 CRITICAL

Description

An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write access on the affected device.

CVE ID: CVE-2025-41709
State: PUBLISHED
Assigner: CERTVDE
Reserved: 2025-04-16 11:17 UTC
Published: 2026-03-10 08:26 UTC
Last updated: 2026-03-18 08:16 UTC
Primary CWE: CWE-78
CWE-78 Improper Neutralization of Special Elements used in a…
Vendor / Product: Janitza / UMG 96RM-E 24V(5222063)
Sources: cve.org · NVD

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC — CISA Coordinator

Affected products (4)

Vendor	Product	Platform	Versions
Janitza	UMG 96RM-E 230V(5222062)	—	0.0 ≤ 3.13
Janitza	UMG 96RM-E 24V(5222063)	—	0.0 ≤ 3.13
Weidmueller	ENERGY METER 750-230 (2540910000)	—	0.0 ≤ 3.13
Weidmueller	ENERGY METER 750-24 (2540900000)	—	0.0 ≤ 3.13

Weakness (CWE)

CWE	Source	Description
CWE-78	cna	CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CVSS scores (1)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References (4)