CVE-2025-41679 - Vulnerability Details - OpenCVE

An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Vendors	Products
Helmholz	Rex 100
Mb Connect Line	Mbnet.mini

No data.

No data.

References

Link	Providers
https://certvde.com/de/advisories/VDE-2025-058

History

Mon, 28 Jul 2025 13:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Helmholz Helmholz rex 100 Mb Connect Line Mb Connect Line mbnet.mini
Vendors & Products		Helmholz Helmholz rex 100 Mb Connect Line Mb Connect Line mbnet.mini

Mon, 21 Jul 2025 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 21 Jul 2025 09:45:00 +0000

Type	Values Removed	Values Added
Description		An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service.
Title		Unauthenticated Buffer Overflow in Conftool Service Leading to Denial of Service
Weaknesses		CWE-787
References		https://certvde.com/de/advisories/VDE-2025-058
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2025-07-21T09:31:04.713Z

Updated: 2025-07-21T12:31:24.437Z

Reserved: 2025-04-16T11:17:48.308Z

Link: CVE-2025-41679

Vulnrichment

Updated: 2025-07-21T12:31:03.385Z

NVD

Status : Awaiting Analysis

Published: 2025-07-21T10:15:25.133

Modified: 2025-07-22T13:06:07.260

Link: CVE-2025-41679

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-41679", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2025-04-16T11:17:48.308Z", "datePublished": "2025-07-21T09:31:04.713Z", "dateUpdated": "2025-07-21T12:31:24.437Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "mbNET.mini", "vendor": "MB connect line", "versions": [{"lessThan": "2.3.3", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "REX 100", "vendor": "Helmholz", "versions": [{"lessThan": "2.3.3", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "F. Bruckmoser, M. Eder, J. Heigl, M. Heudorn, G. Hofmarcher, M. Kadlec, M. Pristauz-Telsnigg, S. Resch, P. Schweinzer, M. Gschiel from St. Poelten UAS"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service.<br>"}], "value": "An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-07-21T09:31:04.713Z"}, "references": [{"url": "https://certvde.com/de/advisories/VDE-2025-058"}], "source": {"advisory": "VDE-2025-058, VDE-2025-059", "defect": ["CERT@VDE#641816", "CERT@VDE#641817"], "discovery": "UNKNOWN"}, "title": "Unauthenticated Buffer Overflow in Conftool Service Leading to Denial of Service", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-21T12:30:59.892256Z", "id": "CVE-2025-41679", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-21T12:31:24.437Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-41679", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-21T12:30:59.892256Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-21T12:31:03.385Z"}}], "cna": {"title": "Unauthenticated Buffer Overflow in Conftool Service Leading to Denial of Service", "source": {"defect": ["CERT@VDE#641816", "CERT@VDE#641817"], "advisory": "VDE-2025-058, VDE-2025-059", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "F. Bruckmoser, M. Eder, J. Heigl, M. Heudorn, G. Hofmarcher, M. Kadlec, M. Pristauz-Telsnigg, S. Resch, P. Schweinzer, M. Gschiel from St. Poelten UAS"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "MB connect line", "product": "mbNET.mini", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2.3.3", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Helmholz", "product": "REX 100", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "2.3.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://certvde.com/de/advisories/VDE-2025-058"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service.", "supportingMedia": [{"type": "text/html", "value": "An unauthenticated remote attacker could exploit a buffer overflow vulnerability in the device causing a denial of service that affects only the network initializing wizard (Conftool) service.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-07-21T09:31:04.713Z"}}}, "cveMetadata": {"cveId": "CVE-2025-41679", "state": "PUBLISHED", "dateUpdated": "2025-07-21T12:31:24.437Z", "dateReserved": "2025-04-16T11:17:48.308Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2025-07-21T09:31:04.713Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.1"}