CVE-2025-41688 - Vulnerability Details - OpenCVE

A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Helmholz	Rex 200 Rex 300
Mbconnectline	Mbnet Hw1 Mbnet Mbnet.rokey

No data.

No data.

References

Link	Providers
https://certvde.com/de/advisories/VDE-2025-065
https://certvde.com/de/advisories/VDE-2025-069

History

Thu, 31 Jul 2025 21:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Helmholz Helmholz rex 200 Helmholz rex 300 Mbconnectline Mbconnectline mbnet Hw1 Mbconnectline mbnet Mbnet.rokey
Vendors & Products		Helmholz Helmholz rex 200 Helmholz rex 300 Mbconnectline Mbconnectline mbnet Hw1 Mbconnectline mbnet Mbnet.rokey

Thu, 31 Jul 2025 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Thu, 31 Jul 2025 10:15:00 +0000

Type	Values Removed	Values Added
Description		A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox.
Title		High Privilege RCE via LUA Sandbox Escape
Weaknesses		CWE-653
References		https://certvde.com/de/advisories/VDE-2025-065 https://certvde.com/de/advisories/VDE-2025-069
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2025-07-31T10:02:49.655Z

Updated: 2025-07-31T13:17:23.918Z

Reserved: 2025-04-16T11:17:48.309Z

Link: CVE-2025-41688

Vulnrichment

Updated: 2025-07-31T13:17:19.887Z

NVD

Status : Awaiting Analysis

Published: 2025-07-31T10:15:26.763

Modified: 2025-07-31T18:42:37.870

Link: CVE-2025-41688

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-41688", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2025-04-16T11:17:48.309Z", "datePublished": "2025-07-31T10:02:49.655Z", "dateUpdated": "2025-07-31T13:17:23.918Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "mbNET HW1", "vendor": "MB connect line", "versions": [{"lessThanOrEqual": "5.1.11", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "mbNET/mbNET.rokey", "vendor": "MB connect line", "versions": [{"lessThan": "7.3.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "REX 300", "vendor": "Helmholz", "versions": [{"lessThanOrEqual": "5.1.11", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "REX 200/250", "vendor": "Helmholz", "versions": [{"lessThan": "7.3.0", "status": "affected", "version": "0.0.0", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Marcel Rick-Cen"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox.<br>"}], "value": "A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-653", "description": "CWE-653 Improper Isolation or Compartmentalization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-07-31T10:02:49.655Z"}, "references": [{"url": "https://certvde.com/de/advisories/VDE-2025-065"}, {"url": "https://certvde.com/de/advisories/VDE-2025-069"}], "source": {"advisory": "VDE-2025-065, VDE-2025-069", "defect": ["CERT@VDE#641828"], "discovery": "UNKNOWN"}, "title": "High Privilege RCE via LUA Sandbox Escape", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-31T13:17:09.687569Z", "id": "CVE-2025-41688", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-31T13:17:23.918Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-41688", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-31T13:17:09.687569Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-31T13:17:19.887Z"}}], "cna": {"title": "High Privilege RCE via LUA Sandbox Escape", "source": {"defect": ["CERT@VDE#641828"], "advisory": "VDE-2025-065, VDE-2025-069", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Marcel Rick-Cen"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "MB connect line", "product": "mbNET HW1", "versions": [{"status": "affected", "version": "0.0.0", "versionType": "semver", "lessThanOrEqual": "5.1.11"}], "defaultStatus": "unaffected"}, {"vendor": "MB connect line", "product": "mbNET/mbNET.rokey", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "7.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Helmholz", "product": "REX 300", "versions": [{"status": "affected", "version": "0.0.0", "versionType": "semver", "lessThanOrEqual": "5.1.11"}], "defaultStatus": "unaffected"}, {"vendor": "Helmholz", "product": "REX 200/250", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "7.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://certvde.com/de/advisories/VDE-2025-065"}, {"url": "https://certvde.com/de/advisories/VDE-2025-069"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox.", "supportingMedia": [{"type": "text/html", "value": "A high privileged remote attacker can execute arbitrary OS commands using an undocumented method allowing to escape the implemented LUA sandbox.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-653", "description": "CWE-653 Improper Isolation or Compartmentalization"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-07-31T10:02:49.655Z"}}}, "cveMetadata": {"cveId": "CVE-2025-41688", "state": "PUBLISHED", "dateUpdated": "2025-07-31T13:17:23.918Z", "dateReserved": "2025-04-16T11:17:48.309Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2025-07-31T10:02:49.655Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.1"}