Vulnerability · Published Mar 10, 2026 · Assigned by CERTVDE
CVE-2025-41711Use of a Broken or Risky Cryptographic Algorithm for firmware images of power analyzer
Medium 5.3
In plain English
A medium-severity broken cryptography in UMG 96RM-E 230V(5222062) from Janitza. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 70.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An unauthenticated remote attacker can use firmware images to extract password hashes and brute force plaintext passwords of accounts with limited access.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Janitza | UMG 96RM-E 24V(5222063) | 0.0 – through 3.13 |
| Janitza | UMG 96RM-E 230V(5222062) | 0.0 – through 3.13 |
| Weidmueller | ENERGY METER 750-230 (2540910000) | 0.0 – through 3.13 |
| Weidmueller | ENERGY METER 750-24 (2540900000) | 0.0 – through 3.13 |
Weakness: CWE-327 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://certvde.com/en/advisories/VDE-2025-079/ vendor-advisory
- https://certvde.com/en/advisories/VDE-2025-096/ vendor-advisory
- https://janitza.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-079.json vendor-advisory
- https://weidmueller.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2025-096.json vendor-advisory