Summary
Bender is publishing this advisory to inform customers about two vulnerabilities in the Linux kernel used by the EDGE500IP. CISA has added both vulnerabilities (CVE-2025-39682 and CVE-2025-39964) to its Known Exploited Vulnerabilities catalog.
Bender has analyzed the vulnerabilities and determined that the electrical safety of the devices is not affected. Exploitation on the EDGE500IP requires code execution on the device, which is not available to users. Bender nevertheless considers the vulnerabilities to be of medium risk and has fixed them in COMTRAXX firmware 5.1.1.
Details
Impact
An attacker who is already able to execute code locally on the device could use the vulnerabilities in the kernel TLS implementation (CVE-2025-39682) or the AF_ALG crypto socket interface (CVE-2025-39964) to compromise the confidentiality, integrity and availability of the device.
Mitigation
Restrict network access to the device to trusted networks and users, and do not install firmware from untrusted sources.
Remediation
Install COMTRAXX firmware 5.1.1 or later (https://www.bender.de/service-support/downloadbereich).
Product Description
The EDGE500IP is a COMTRAXX gateway for monitoring, visualizing and parameterizing Bender devices and integrating them into higher-level systems.
Vulnerabilities 2
-
Critical 9.8
tls: fix handling of zero-length records on the rx_list
In the Linux kernel, the following vulnerability has been resolved: tls: fix handling of zero-length records on the rx_list Each recvmsg() call must process either - only contiguous DATA records (any number of them) - one non-DATA record If the next record ha…
KEV Sep 18, 2026 -
High 7.8
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes to the same af_alg socket is bogus as the data will be interleaved in an unpredictable fashion. Furthermore, c…
KEV Sep 18, 2026
Revision history
-
#1.0.0
Initial revision.
References
-
VDE-2026-143: Bender EDGE500IP Vulnerabilities - Linux Kernel (TLS and AF_ALG) - HTML
https://certvde.com/en/advisories/VDE-2026-143/
-
Vendor PSIRT
https://www.bender.de
-
CERT@VDE Security Advisories for Bender GmbH & Co. KG
https://certvde.com/en/advisories/vendor/bender/
-
CISA Known Exploited Vulnerabilities Catalog
https://www.cisa.gov/known-exploited-vulnerabilities-catalog