PT-2025-24678 · Unknown · Energy Services

Published 2025-06-10 · Updated 2025-06-10 · CVE-2025-40585

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Energy Services versions with G5DFR

Description A vulnerability has been identified in Energy Services where affected solutions using G5DFR contain default credentials. This could allow an attacker to gain control of the G5DFR component and tamper with outputs from the device.

Recommendations For Energy Services versions with G5DFR, consider changing the default credentials to prevent unauthorized access. As a temporary workaround, restrict access to the G5DFR component to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2025-06675

CVE-2025-40585

Affected Products

Energy Services

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-40585 · Security Note
• https://bdu.fstec.ru/vul/2025-06675 · Security Note
• https://twitter.com/CVEnew/status/1932465949510086909 · Twitter Post
• https://cert-portal.siemens.com/productcert/html/ssa-345750.html · Note