CVE-2025-41730
Published: 10 December 2025
Summary
CVE-2025-41730 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Wago 0852-1328 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 mandates identification, prioritization, and remediation of flaws such as the unsafe sscanf buffer overflow in CVE-2025-41730 to prevent exploitation.
SI-16 enforces memory protections like stack canaries and non-executable stacks that directly mitigate stack-based buffer overflow exploits in CVE-2025-41730.
SI-10 requires input validation at entry points to block malformed inputs that trigger the unsafe sscanf buffer overflow in check_account() for CVE-2025-41730.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated remote exploitation over the network of a public-facing service, directly enabling T1190 (Exploit Public-Facing Application) for initial access and full device compromise via stack buffer overflow.
NVD Description
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
Deeper analysisAI
CVE-2025-41730 is a vulnerability stemming from unsafe sscanf calls within the check_account() function, which allow writing arbitrary data into fixed-size stack buffers. This issue maps to CWE-121 (Stack-based Buffer Overflow) and CWE-787 (Out-of-bounds Write), resulting in full device compromise. Published on 2025-12-10, it carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with high impacts on confidentiality, integrity, and availability.
An unauthenticated remote attacker can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation enables full device compromise through stack buffer manipulation.
The advisory at https://certvde.com/de/advisories/VDE-2025-095 provides details on mitigation and patches.
Details
- CWE(s)