CVE-2025-41699
Published: 14 October 2025
Summary
CVE-2025-41699 is a high-severity Code Injection (CWE-94) vulnerability in Certvde (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 49.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-5 (Access Restrictions for Change) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-41699 is a code injection vulnerability (CWE-94) in the Web-based management interface of Phoenix Contact products. It stems from improper control of code generation, allowing a low-privileged remote attacker with an account to modify system configuration and execute arbitrary commands as root. This results in a total loss of confidentiality, integrity, and availability, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability was published on 2025-10-14.
A low-privileged remote attacker possessing a valid account for the Web-based management interface can exploit this vulnerability over the network with no user interaction required. By altering configuration settings, the attacker injects commands that execute with root privileges, enabling full system compromise including data exfiltration, modification, or disruption.
Mitigation guidance is available in the vendor advisory published as a CSAF document at https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-074.json.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-34144
Vulnerability details
An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resulting in a total loss of confidentiality, availability and integrity due to improper control of generation…
more
of code ('Code Injection').
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability in the web-based management interface enables low-privileged remote attackers to perform command injection with root privileges, directly facilitating T1190 (Exploit Public-Facing Application), T1068 (Exploitation for Privilege Escalation), and T1059 (Command and Scripting Interpreter).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents code injection by requiring validation of configuration inputs to the web-based management interface, blocking malicious command insertion.
Restricts access to configuration changes, preventing low-privileged users from modifying system settings that enable root command injection.
Enforces least privilege on web management processes, limiting the scope of command execution even if injection occurs.