CVE-2025-25268 — Unauthenticated Configuration Access via Exposed API Endpoint

CVE-2025-25268

Unauthenticated Configuration Access via Exposed API Endpoint PUBLISHED

Description (CNA)

An unauthenticated adjacent attacker can modify configuration by sending specific requests to an API-endpoint resulting in read and write access due to missing authentication.

Affected (CNA)

Vendor / product	Versions
Phoenix Contact / CHARX SEC-3150	affected 0.0.0 before 1.7.3
Phoenix Contact / CHARX SEC-3100	affected 0.0.0 before 1.7.3
Phoenix Contact / CHARX SEC-3050	affected 0.0.0 before 1.7.3
Phoenix Contact / CHARX SEC-3000	affected 0.0.0 before 1.7.3

CWE

CWE-306

References

https://certvde.com/de/advisories/VDE-2025-019

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.