CVE-2025-41709

An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write access on the affected device.

Score

CVSS 3.1 9.8 Critical

Status

Awaiting Analysis - info@cert.vde.com

Published

2026-03-10

Last modified

2026-03-18

Weaknesses

CWE-78

Affected products

• Umg 96rm-e 230v5222062 (Janitza)
• Umg 96rm-e 24v5222063 (Janitza)
• Energy Meter 750-230 2540910000 (Weidmueller)
• Energy Meter 750-24 2540900000 (Weidmueller)

References

• https://certvde.com/en/advisories/VDE-2025-079/
• https://certvde.com/en/advisories/VDE-2025-096/
• https://janitza.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-079.json
• https://weidmueller.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-096.json