Description
An unauthenticated remote attacker can perform a command injection via Modbus-TCP or Modbus-RTU to gain read and write access on the affected device.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Janitza | UMG 96RM-E 24V(5222063) | 0.0 – ≤ 3.13 | — |
| Janitza | UMG 96RM-E 230V(5222062) | 0.0 – ≤ 3.13 | — |
| Weidmueller | ENERGY METER 750-230 (2540910000) | 0.0 – ≤ 3.13 | — |
| Weidmueller | ENERGY METER 750-24 (2540900000) | 0.0 – ≤ 3.13 | — |
Advisories 2
- VDE-2025-079 Janitza: Multiple vulnerabilities in UMG 96RM-E CERT@VDE · Mar 10, 2026
- VDE-2025-096 Weidmueller: Multiple vulnerabilities in Energy Meter 750-24 and Energy Meter 750-230 CERT@VDE · Mar 10, 2026
References
- https://certvde.com/en/advisories/VDE-2025-079/ vendor-advisory
- https://certvde.com/en/advisories/VDE-2025-096/ vendor-advisory
- https://janitza.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-079.json vendor-advisory
- https://weidmueller.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-096.json vendor-advisory