CVE-2025-41656

Pilz: Missing Authentication in Node-RED integration PUBLISHED

Description (CNA)

An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node_RED server is not configured by default.

Affected (CNA)

Vendor / product	Versions
Pilz / IndustrialPI 4 with Firmware Bullseye	affected 0 through 2024-08

CWE

CWE-306

References

https://certvde.com/en/advisories/VDE-2025-045

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.