CVE-2025-41732
Published: 10 December 2025
Summary
CVE-2025-41732 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Wago 0852-1328 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the unsafe sscanf calls causing stack buffer overflows by identifying, patching, and verifying fixes for this specific flaw.
Implements memory safeguards such as stack canaries, ASLR, and DEP to prevent arbitrary code execution from stack buffer overflows even if exploitation occurs.
Validates incoming cookie inputs prior to processing by check_cookie() to block malformed data that could trigger the sscanf buffer overflow.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Unauthenticated remote buffer overflow vulnerability enables arbitrary code execution and full device compromise over the network, directly facilitating T1190: Exploit Public-Facing Application.
NVD Description
An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which leads to full device compromise.
Deeper analysisAI
CVE-2025-41732, published on 2025-12-10, is a critical vulnerability (CVSS 9.8) stemming from unsafe sscanf calls in the check_cookie() function. These calls enable writing arbitrary data into fixed-size stack buffers, resulting in full device compromise. It is associated with CWE-121 (stack-based buffer overflow) and CWE-787 (out-of-bounds write), affecting an unspecified software component or device that exposes this function.
An unauthenticated remote attacker can exploit this vulnerability over the network with low attack complexity and no user interaction or privileges required. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, culminating in complete device takeover as described.
The primary advisory reference, available at https://certvde.com/de/advisories/VDE-2025-095, provides further details on this issue, including potential mitigation guidance.
Details
- CWE(s)