{"id":"CVE-2025-3496","state":"PUBLISHED","title":"AUMA Riester: Buffer overflow in service telegram","description":"An unauthenticated remote attacker can cause a buffer overflow which could lead to unexpected behaviour or DoS via Bluetooth or RS-232 interface.","publishedAt":"2025-05-12T08:01:57.671Z","updatedAt":"2025-05-16T09:00:16.307Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","source":"CERTVDE"},"assigner":"CERTVDE","products":["Auma Riester AC1.2","Auma Riester MEC 03.01","Auma Riester PROFOX","Auma Riester SGx/SVx","Auma Riester TIGRON","Auma Riester TIGRON SIL"],"affected":[{"vendor":"Auma Riester","product":"AC1.2","defaultStatus":"unaffected","versions":[{"version":"06.00.00","status":"affected","lessThan":"06.09.04","versionType":"semver"}]},{"vendor":"Auma Riester","product":"MEC 03.01","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"01.02.00","versionType":"semver"}]},{"vendor":"Auma Riester","product":"PROFOX","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"01-01.10.00","versionType":"semver"}]},{"vendor":"Auma Riester","product":"SGx/SVx","defaultStatus":"unaffected","versions":[{"version":"03.00.00","status":"affected","lessThan":"03.05.01","versionType":"semver"}]},{"vendor":"Auma Riester","product":"TIGRON","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"01-01.09.00","versionType":"semver"}]},{"vendor":"Auma Riester","product":"TIGRON SIL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"02-01.01.00","versionType":"semver"}]}],"references":["https://cert.vde.com/en/advisories/VDE-2025-026"],"weaknesses":["CWE-120"],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/3xxx/CVE-2025-3496.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-3496","state":"PUBLISHED","datePublished":"2025-05-12T08:01:57.671Z","dateUpdated":"2025-05-16T09:00:16.307Z","assignerShortName":"CERTVDE","assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateReserved":"2025-04-10T08:26:28.797Z"},"containers":{"cna":{"title":"AUMA Riester: Buffer overflow in service telegram","descriptions":[{"lang":"en","value":"An unauthenticated remote attacker can cause a buffer overflow which could lead to unexpected behaviour or DoS via Bluetooth or RS-232 interface."}],"affected":[{"vendor":"Auma Riester","product":"AC1.2","defaultStatus":"unaffected","versions":[{"version":"06.00.00","status":"affected","lessThan":"06.09.04","versionType":"semver"}]},{"vendor":"Auma Riester","product":"MEC 03.01","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"01.02.00","versionType":"semver"}]},{"vendor":"Auma Riester","product":"PROFOX","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"01-01.10.00","versionType":"semver"}]},{"vendor":"Auma Riester","product":"SGx/SVx","defaultStatus":"unaffected","versions":[{"version":"03.00.00","status":"affected","lessThan":"03.05.01","versionType":"semver"}]},{"vendor":"Auma Riester","product":"TIGRON","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"01-01.09.00","versionType":"semver"}]},{"vendor":"Auma Riester","product":"TIGRON SIL","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"02-01.01.00","versionType":"semver"}]}],"references":[{"url":"https://cert.vde.com/en/advisories/VDE-2025-026"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-120","description":"CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERTVDE","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateUpdated":"2025-05-16T09:00:16.307Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Dennis Schaefer from ONEKEY GmbH"}],"source":{"advisory":"VDE-2025-026","defect":["CERT@VDE#641760"],"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-05-12T14:30:11.496582Z","id":"CVE-2025-3496","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-05-12T14:32:49.221Z"}}]}}}