Summary
Weidmueller industrial ethernet switches are affected by multiple vulnerabilities.
Weidmueller has released new firmwares of the affected products to fix the vulnerabilities.
Details
Impact
Weidmueller industrial ethernet switches are vulnerable to multiple vulnerabilities. The security of the devices may be compromised. Further information can be found under vulnerability details.
Remediation
Update to the new version as listed in the following table:
| Product | Affected Version | Fixed Version |
|----------------------------------|------------------|---------------|
| IE-SW-VL05M-5TX | <V3.6.32 | V3.6.32 |
| IE-SW-VL05MT-5TX | <V3.6.32 | V3.6.32 |
| IE-SW-VL08MT-8TX | <V3.5.36 | V3.5.36 |
| IE-SW-VL08MT-5TX-1SC-2SCS | <V3.5.36 | V3.5.36 |
| IE-SW-VL08MT-6TX-2SC | <V3.5.36 | V3.5.36 |
| IE-SW-VL08MT-6TX-2ST | <V3.5.36 | V3.5.36 |
| IE-SW-VL08MT-6TX-2SCS | <V3.5.36 | V3.5.36 |
| IE-SW-PL10M-3GT-7TX | <V3.3.34 | V3.3.34 |
| IE-SW-PL10MT-3GT-7TX | <V3.3.34 | V3.3.34 |
| IE-SW-PL16M-16TX | <V3.4.32 | V3.4.32 |
| IE-SW-PL16MT-16TX | <V3.4.32 | V3.4.32 |
| IE-SW-PL18M-2GC-16TX | <V3.4.40 | V3.4.40 |
| IE-SW-PL18MT-2GC-16TX | <V3.4.40 | V3.4.40 |
Vulnerabilities 5
-
Critical 9.8
Weidmueller: Missing Authentication Vulnerability in Industrial Ethernet Switches
Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling unauthorized upload or download of configuration files and leading to full system compromise.
-
Critical 9.8
Weidmueller: Authentication Bypass Vulnerability in Industrial Ethernet Switches
The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker could exploit this weakness by performing brute-force attacks to guess valid credentials or by using MD5 collision technique…
-
High 7.5
Weidmueller: Out-of-Bounds Write Vulnerability in Industrial Ethernet Switches
An unauthenticated remote attacker can exploit insufficient input validation to write data beyond the bounds of a buffer, potentially leading to a denial-of-service condition for the devices.
-
High 7.5
Weidmueller: Denial-of-Service Vulnerability in Industrial Ethernet Switches
An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations and potentially cause a denial-of-service.
-
High 7.5
Weidmueller: Denial-of-Service Vulnerability in the web server functionality of Industrial Ethernet Switches
An unauthenticated remote attacker can exploit a denial-of-service vulnerability in the device's web server functionality by sending a specially crafted HTTP request with a malicious header, potentially causing the server to crash or become unresponsive.
Revision history
-
#1.1.0
Update: CWE from CVE-2025-41652, Revision History
-
#1.0.0
Initial version
References
-
Weidmueller Security Advisory Board
https://support.weidmueller.com/support-center/popular-resources/security-advisory-board
-
CERT@VDE Security Advisories for Weidmueller
https://certvde.com/de/advisories/vendor/weidmueller/
-
VDE-2025-044: Weidmueller: Industrial ethernet switches are affected by multiple vulnerabilities - HTML
https://certvde.com/de/advisories/VDE-2025-044