Description (CNA)
An unauthenticated remote attacker who tricks a user to upload a manipulated HTML file can get access to sensitive information on the device. This is a result of incorrect permission assignment for the web server.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Janitza / UMG 96RM-E 24V(5222063) | affected 0.0 through 3.13 |
| Janitza / UMG 96RM-E 230V(5222062) | affected 0.0 through 3.13 |
| Weidmueller / ENERGY METER 750-230 (2540910000) | affected 0.0 through 3.13 |
| Weidmueller / ENERGY METER 750-24 (2540900000) | affected 0.0 through 3.13 |
CWE
CWE-732
References
- https://certvde.com/en/advisories/VDE-2025-079/
- https://certvde.com/en/advisories/VDE-2025-096/
- https://janitza.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-079.json
- https://weidmueller.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-096.json
ADP enrichment
No English description supplied.
No references supplied.