CVE-2025-41647 MEDIUM

CVE-2025-41647: Lenze: Plaintext Password Disclosure in PLC Designer V4 Interface

Vendor Lenze
Product PLC Designer V4
Weakness CWE-312 · Cleartext storage
Published June 25, 2025
Last update June 25, 2025
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the password being displayed in plain text under special conditions.

Key dates

02Disclosure timeline

June 25, 2025 CVE published
June 25, 2025 Record updated