CVE-2025-41699

HighRCE

Published: 14 October 2025

Published

14 October 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0028 51.4th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-41699 is a high-severity Code Injection (CWE-94) vulnerability in Certvde (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 48.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-5 (Access Restrictions for Change) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly prevents code injection by requiring validation of configuration inputs to the web-based management interface, blocking malicious command insertion.

CM-5 Access Restrictions for Change good match

prevent

Restricts access to configuration changes, preventing low-privileged users from modifying system settings that enable root command injection.

AC-6 Least Privilege partial match

prevent

Enforces least privilege on web management processes, limiting the scope of command execution even if injection occurs.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1059 Command and Scripting Interpreter Execution

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

attack.mitre.org →

Why these techniques?

The vulnerability in the web-based management interface enables low-privileged remote attackers to perform command injection with root privileges, directly facilitating T1190 (Exploit Public-Facing Application), T1068 (Exploitation for Privilege Escalation), and T1059 (Command and Scripting Interpreter).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

An low privileged remote attacker with an account for the Web-based management can change the system configuration to perform a command injection as root, resulting in a total loss of confidentiality, availability and integrity due to improper control of generation…

of code ('Code Injection').

Deeper analysisAI

CVE-2025-41699 is a code injection vulnerability (CWE-94) in the Web-based management interface of Phoenix Contact products. It stems from improper control of code generation, allowing a low-privileged remote attacker with an account to modify system configuration and execute arbitrary commands as root. This results in a total loss of confidentiality, integrity, and availability, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The vulnerability was published on 2025-10-14.

A low-privileged remote attacker possessing a valid account for the Web-based management interface can exploit this vulnerability over the network with no user interaction required. By altering configuration settings, the attacker injects commands that execute with root privileges, enabling full system compromise including data exfiltration, modification, or disruption.

Mitigation guidance is available in the vendor advisory published as a CSAF document at https://phoenixcontact.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-074.json.