{"id":"CVE-2025-48466","state":"PUBLISHED","title":"Modbus Command Injection without Authentication","description":"Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TCP packets to manipulate Digital Outputs, potentially allowing remote control of relay channel which may lead to operational or safety risks.","publishedAt":"2025-06-24T02:12:41.743Z","updatedAt":"2025-06-25T12:59:38.016Z","severity":{"score":8.1,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","source":"CSA"},"assigner":"CSA","products":["Advantech Advantech Wireless Sensing and Equipment (WISE)"],"affected":[{"vendor":"Advantech","product":"Advantech Wireless Sensing and Equipment (WISE)","defaultStatus":"unknown","versions":[{"version":"A2.01 B00","status":"affected"}]}],"references":["https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061","https://github.com/shipcod3/CVE-2025-48466"],"weaknesses":["CWE-863"],"ingestedAt":"2026-10-29T20:09:23.771Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/48xxx/CVE-2025-48466.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2025-48466","state":"PUBLISHED","datePublished":"2025-06-24T02:12:41.743Z","dateUpdated":"2025-06-25T12:59:38.016Z","assignerShortName":"CSA","assignerOrgId":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","dateReserved":"2025-05-22T09:41:25.402Z"},"containers":{"cna":{"title":"Modbus Command Injection without Authentication","descriptions":[{"lang":"en","value":"Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TCP packets to manipulate Digital Outputs, potentially allowing remote control of relay channel which may lead to operational or safety risks."}],"affected":[{"vendor":"Advantech","product":"Advantech Wireless Sensing and Equipment (WISE)","defaultStatus":"unknown","versions":[{"version":"A2.01 B00","status":"affected"}]}],"references":[{"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2025-061"},{"url":"https://github.com/shipcod3/CVE-2025-48466"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"providerMetadata":{"shortName":"CSA","orgId":"5f57b9bf-260d-4433-bf07-b6a79e9bb7d4","dateUpdated":"2025-06-24T02:30:12.664Z"},"credits":[{"lang":"en","type":"finder","value":"Jay Turla"},{"lang":"en","type":"finder","value":"Japz Divino"},{"lang":"en","type":"finder","value":"Jerold Camacho"}],"datePublic":"2025-06-24T02:00:00.000Z","solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Users and administrators of affected products are advised to update to firmware version A2.02 B00 and disable Modbus TCP if it is not required in their deployment.\n\n<br>"}],"value":"Users and administrators of affected products are advised to update to firmware version A2.02 B00 and disable Modbus TCP if it is not required in their deployment."}],"source":{"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-06-24T15:25:23.267947Z","id":"CVE-2025-48466","options":[{"Exploitation":"poc"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","type":"CWE","lang":"en","description":"CWE-863 Incorrect Authorization"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-06-25T12:59:38.016Z"}}]}}}