High severity · published Sep 8, 2025
CVE-2025-41708
Cleartext Transmission of Sensitive Data via Insecure HTTP Web Interface
7.4
CVSS
0.2%
EPSS
No
On KEV
Description
Due to an unsecure default configuration HTTP is used instead of HTTPS for the web interface. An unauthenticated attacker on the same network could exploit this to learn sensitive data during transmission.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CC
CC612 · Bender
0.0.0 through all versions · source: vendor
CC
CC613 · Bender
0.0.0 through all versions · source: vendor
IC
ICC13xx · Bender
0.0.0 through all versions · source: vendor
IC
ICC15xx · Bender
0.0.0 through all versions · source: vendor
IC
ICC16xx · Bender
0.0.0 through all versions · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-41708
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-41708
certvde.com
https://certvde.com/de/advisories/VDE-2025-084
More from CC612
8.8
CVE-2025-41682
Credential Disclosure via Insecure Storage on Charge Controller