{"id":"CVE-2025-41708","state":"PUBLISHED","title":"Cleartext Transmission of Sensitive Data via Insecure HTTP Web Interface","description":"Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission.","publishedAt":"2025-09-08T06:38:50.386Z","updatedAt":"2025-09-08T18:04:06.675Z","severity":{"score":7.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","source":"CERTVDE"},"assigner":"CERTVDE","products":["Bender CC612","Bender CC613","Bender ICC15xx","Bender ICC16xx","Bender ICC13xx"],"affected":[{"vendor":"Bender","product":"CC612","defaultStatus":"unaffected","versions":[{"version":"0.0.0","status":"affected","lessThanOrEqual":"all versions","versionType":"semver"}]},{"vendor":"Bender","product":"CC613","defaultStatus":"unaffected","versions":[{"version":"0.0.0","status":"affected","lessThanOrEqual":"all versions","versionType":"semver"}]},{"vendor":"Bender","product":"ICC15xx","defaultStatus":"unaffected","versions":[{"version":"0.0.0","status":"affected","lessThanOrEqual":"all versions","versionType":"semver"}]},{"vendor":"Bender","product":"ICC16xx","defaultStatus":"unaffected","versions":[{"version":"0.0.0","status":"affected","lessThanOrEqual":"all versions","versionType":"semver"}]},{"vendor":"Bender","product":"ICC13xx","defaultStatus":"unaffected","versions":[{"version":"0.0.0","status":"affected","lessThanOrEqual":"all versions","versionType":"semver"}]}],"references":["https://certvde.com/de/advisories/VDE-2025-084"],"weaknesses":["CWE-319"],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/41xxx/CVE-2025-41708.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-41708","state":"PUBLISHED","datePublished":"2025-09-08T06:38:50.386Z","dateUpdated":"2025-09-08T18:04:06.675Z","assignerShortName":"CERTVDE","assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateReserved":"2025-04-16T11:17:48.311Z"},"containers":{"cna":{"title":"Cleartext Transmission of Sensitive Data via Insecure HTTP Web Interface","descriptions":[{"lang":"en","value":"Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission."}],"affected":[{"vendor":"Bender","product":"CC612","defaultStatus":"unaffected","versions":[{"version":"0.0.0","status":"affected","lessThanOrEqual":"all versions","versionType":"semver"}]},{"vendor":"Bender","product":"CC613","defaultStatus":"unaffected","versions":[{"version":"0.0.0","status":"affected","lessThanOrEqual":"all versions","versionType":"semver"}]},{"vendor":"Bender","product":"ICC15xx","defaultStatus":"unaffected","versions":[{"version":"0.0.0","status":"affected","lessThanOrEqual":"all versions","versionType":"semver"}]},{"vendor":"Bender","product":"ICC16xx","defaultStatus":"unaffected","versions":[{"version":"0.0.0","status":"affected","lessThanOrEqual":"all versions","versionType":"semver"}]},{"vendor":"Bender","product":"ICC13xx","defaultStatus":"unaffected","versions":[{"version":"0.0.0","status":"affected","lessThanOrEqual":"all versions","versionType":"semver"}]}],"references":[{"url":"https://certvde.com/de/advisories/VDE-2025-084"}],"metrics":[{"cvssV3_1":{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-319","description":"CWE-319 Cleartext Transmission of Sensitive Information","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERTVDE","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateUpdated":"2025-09-08T06:38:50.386Z"},"credits":[{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Dr. Matthias Kesenheimer by SySS GmbH"},{"lang":"en","type":"finder","user":"00000000-0000-4000-9000-000000000000","value":"Sebastian Hamann by SySS GmbH"}],"source":{"advisory":"VDE-2025-084","defect":["CERT@VDE#641854"],"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-09-08T18:03:02.845880Z","id":"CVE-2025-41708","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-09-08T18:04:06.675Z"}}]}}}