CVE-2025-41438 - CVE House
Back to Database
Status published Critical CVE-2025-41438

Consilium Safety CS5000 Fire Panel Initialization of a Resource with an Insecure Default

Vulnerability Description

The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, it has remained unchanged on every installed system observed. This account is not root but holds high-level permissions that could severely impact the device's operation if exploited.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-41438

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Andrew Tierney of Pen Test Partners reported these vulnerabilities to CISA.

References

More from Consilium Safety

View All →
CVE-2025-46352
Consilium Safety CS5000 Fire Panel Use of Hard-coded Credentials
Critical 9.3

Affected Vendor

Consilium Safety

View all reports →

Affected Software

CS5000 Fire Panel
Vulnerable Versions:
All versions

Timeline

Official Publish: May 29th, 2025
Last Modified: May 30th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-1188

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.