CVE-2025-41438

Katalog CVE

CVSS 9.8 · Critical EPSS 0,73%

Kerentanan Initialization of a Resource with an Insecure Default. Skor CVSS 3.1 9.8 (Critical) menurut hq.dhs.gov.

Deskripsi (NVD)

The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, it has remained unchanged on every installed system observed. This account is not root but holds high-level permissions that could severely impact the device's operation if exploited.

Rincian

Terbit di NVD

30 Mei 2025

Terakhir diubah

17 Juni 2026

Status NVD

Deferred

CVSS 3.1

9.8 (Critical), sumber hq.dhs.gov
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1188: Initialization of a Resource with an Insecure Default

EPSS (30 hari)

0,73% peluang dieksploitasi; lebih tinggi dari 52,9% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://www.cisa.gov/news-events/ics-advisories/icsa-25-148-03
• https://www.consiliumsafety.com/en/support/