CVE-2025-41712

An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive information on the device. This is a result of incorrect permission assignment for the web server.

Score

CVSS 3.1 6.5 Medium

Status

Deferred - info@cert.vde.com

Published

2026-03-10

Last modified

2026-03-10

Weaknesses

CWE-732

Affected products

• Umg 96rm-e 230v5222062 (Janitza)
• Umg 96rm-e 24v5222063 (Janitza)
• Energy Meter 750-230 2540910000 (Weidmueller)
• Energy Meter 750-24 2540900000 (Weidmueller)

References

• https://certvde.com/en/advisories/VDE-2025-079/
• https://certvde.com/en/advisories/VDE-2025-096/
• https://janitza.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-079.json
• https://weidmueller.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-096.json