CVE-2025-41708 - CVE House

Status published High CVE-2025-41708

Cleartext Transmission of Sensitive Data via Insecure HTTP Web Interface

7.4 CVSS

Vulnerability Description

Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-41708

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Dr. Matthias Kesenheimer by SySS GmbH
Sebastian Hamann by SySS GmbH

References

https://certvde.com/de/advisories/VDE-2025-084

More from Bender

View All →

CVE-2025-41682

Credential Disclosure via Insecure Storage on Charge Controller

High 8.8

Affected Vendor

Bender

View all reports →

Affected Software

CC612, CC613, ICC15xx, ICC16xx, ICC13xx

Vulnerable Versions:

0.0.0

Timeline

Official Publish: September 8th, 2025

Last Modified: September 8th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-319

MITRE ATT&CK TTPs

T1040 Network Sniffing

Collection

T1557 Adversary-in-the-Middle

Credential Access

T1552 Unsecured Credentials