CVE-2025-2595

Published: Apr 23, 2025Modified: Jun 17, 2026Deferred

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: info@cert.vde.com (Secondary)

Description

An unauthenticated remote attacker can bypass the user management in CODESYS Visualization and read visualization template files or static elements by means of forced browsing.

Related CWEs

CWE-425

Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

References (1)

https://certvde.com/en/advisories/VDE-2025-027

Source: info@cert.vde.com

Timeline

No history available yet.