PT-2025-27509 · Node Red · Node-Red

Published 2025-06-27 · Updated 2025-07-06 · CVE-2025-41656

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Node RED (affected versions not specified)

Description: An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the Node RED server is not configured by default.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2025-07806

CVE-2025-41656

Affected Products

Node-Red

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-41656 · Security Note
• https://bdu.fstec.ru/vul/2025-07806 · Security Note
• https://twitter.com/CVEnew/status/1939962677851292109 · Twitter Post
• https://certvde.com/en/advisories/VDE-2025-045 · Note
• https://twitter.com/cracbot/status/1941814437964550193 · Twitter Post
• https://t.me/pentestingnews/63748 · Telegram Post
• https://twitter.com/fridaysecurity/status/1940199322702028935 · Twitter Post
• https://t.me/cvenotify/127209 · Telegram Post
• https://t.me/cvetracker/27492 · Telegram Post
• https://twitter.com/CveFindCom/status/1939967898547593325 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1939963978391621678 · Twitter Post