CVE-2025-41706

{
  "id": "CVE-2025-41706",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-14T08:15:35.820",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The webserver is vulnerable to a denial of service condition. An unauthenticated remote attacker can craft a special GET request with an over-long content-length to trigger the issue without affecting the core functionality."
    },
    {
      "lang": "es",
      "value": "El servidor web es vulnerable a una condición de denegación de servicio. Un atacante remoto no autenticado puede elaborar una solicitud GET especial con una longitud de contenido excesivamente larga para desencadenar el problema sin afectar la funcionalidad principal."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Phoenix Contact",
          "product": "QUINT4-UPS/24DC/24DC/5/EIP",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "VC:00",
              "lessThan": "VC:07",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Phoenix Contact",
          "product": "QUINT4-UPS/24DC/24DC/10/EIP",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "VC:00",
              "lessThan": "VC:07",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Phoenix Contact",
          "product": "QUINT4-UPS/24DC/24DC/20/EIP",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "VC:00",
              "lessThan": "VC:07",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Phoenix Contact",
          "product": "QUINT4-UPS/24DC/24DC/40/EIP",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "VC:00",
              "lessThan": "VC:07",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-14T18:40:44.318321Z",
          "id": "CVE-2025-41706",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://certvde.com/de/advisories/VDE-2025-072",
      "source": "[email protected]"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2025/Oct/12",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}