CVE-2025-41731

{
  "id": "CVE-2025-41731",
  "sourceIdentifier": "[email protected]",
  "published": "2025-11-10T08:15:33.957",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the debug interface is still enabled."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad fue identificada en el algoritmo de generación de contraseñas al acceder a la interfaz de depuración. Un atacante local no autenticado con conocimiento del marco de tiempo de generación de contraseñas podría ser capaz de forzar la contraseña por fuerza bruta de manera oportuna y así obtener acceso de root al dispositivo si la interfaz de depuración todavía está habilitada."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Jumo",
          "product": "variTRON300",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0.0.0.0",
              "lessThan": "9.0.2.5",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Jumo",
          "product": "variTRON500",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0.0.0.0",
              "lessThan": "9.0.2.5",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Jumo",
          "product": "variTRON500 touch",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0.0.0.0",
              "lessThan": "9.0.2.5",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.4,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.4,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-11-10T15:18:58.302257Z",
          "id": "CVE-2025-41731",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-338"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://jumo.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-086.json",
      "source": "[email protected]"
    }
  ]
}