Vulnerability · Published Jun 24, 2025 · Assigned by CSA
CVE-2025-48466Modbus Command Injection without Authentication
High 8.1
In plain English
A high-severity incorrect authorization in Advantech Wireless Sensing and Equipment (WISE) from Advantech. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.6%top 53.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
Successful exploitation of the vulnerability could allow an unauthenticated, remote attacker to send Modbus TCP packets to manipulate Digital Outputs, potentially allowing remote control of relay channel which may lead to operational or safety risks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Advantech | Advantech Wireless Sensing and Equipment (WISE) | A2.01 B00 |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H