ICS Vendor Security Advisories: variTRON, WAGO, Sauter, Pilz, Phoenix Contact (CVE-2025-41731, CVE-2025-1468, etc.)

Critical Vulnerability Information 1. Jumo: Predictable Debug-Interface Password in variTRON Series Vulnerability Summary: The debug interface password generation algorithm in the variTRON series is vulnerable. Due to the PRNG being initialized with the current Unix timestamp, the generated passwords are predictable. CVE ID: CVE-2025-41731 Release Date: November 10, 2025 2. WAGO: Multiple Vulnerabilities in CODESYS Components Vulnerability Summary: Multiple WAGO firmware versions are affected by vulnerabilities in CODESYS components, impacting runtime, visualization, and OPC UA server. CVE IDs: CVE-2025-1468, CVE-2025-0694, CVE-2025-2595 Release Date: November 3, 2025 3. Sauter: Multiple Vulnerabilities in SAUTER Modulo 6 Vulnerability Summary: Multiple vulnerabilities were discovered in the embedded firmware of SAUTER Modulo 6 devices, affecting the embedded web server and interface with SAUTER CASE Suite. CVE IDs: CVE-2025-41723, CVE-2025-41719, CVE-2025-41724, CVE-2025-41722, CVE-2025-41720, CVE-2025-41721 Release Date: October 21, 2025 4. Pilz: Vulnerability Affecting PASvisu Runtime Vulnerability Summary: PASvisu Runtime is affected by a vulnerability in a third-party component, exploitable via malicious web requests. CVE ID: CVE-2025-51495 Release Date: October 20, 2025 5. Phoenix Contact: Security Advisory for CHARX SEC-3xxx Charging Controllers Vulnerability Summary: Vulnerabilities were discovered in the firmware of CHARX SEC-3xxx charging controllers. CVE ID: CVE-2025-41699 Release Date: October 15, 2025 6. Murrelektronik: Cleartext Transmission of Sensitive Information in IMPACT67 Pro Vulnerability Summary: The embedded web interface of MURRELEKTRONIK IMPACT67 Pro PN DIO8 IOL8 devices transmits login credentials via unencrypted HTTP using GET requests, leading to information exposure. CVE ID: CVE-2025-41718 Release Date: October 14, 2025 7. Phoenix Contact: Security Advisory for QUINT4-UPS EIP Vulnerability Summary: Multiple vulnerabilities were found in the firmware of QUINT4-UPS EIP devices, exploitable by unauthorized remote attackers to perform denial-of-service attacks and collect login information. CVE IDs: CVE-2025-41703, CVE-2025-41705, CVE-2025-41707, CVE-2025-41706, CVE-2025-41704 Release Date: October 14, 2025 8. WAGO: Vulnerabilities in Device Sphere and Solution Builder Vulnerability Summary: Due to missing authentication checks, vulnerabilities in WAGO Solution Builder and WAGO Device Sphere could lead to information exposure. CVE IDs: CVE-2025-41715, CVE-2025-41716 Release Date: September 24, 2025

Goal Reached Thanks to every supporter — we hit 100%!

ICS Vendor Security Advisories: variTRON, WAGO, Sauter, Pilz, Phoenix Contact (CVE-2025-41731, CVE-2025-1468, etc.)