CVE-2025-48466

Modbus Command Injection without Authentication

CVSS 8.1 HIGHEPSS 0.5%CWE-863

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 8.1EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Ciclo de vida

24 jun 2025Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TCP packets to manipulate Digital Outputs, potentially allowing remote control of relay channel which may lead to operational or safety risks.

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Produtos afetados

Advantech · Advantech Wireless Sensing and Equipment (WISE)

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://github.com/shipcod3/CVE-2025-48466 https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061