CVE-2025-41656: Pilz: Missing Authentication in Node-RED integration
An unauthenticated remote attacker can run arbitrary commands on the affected devices with high privileges because the authentication for the NodeRED server is not configured by default.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure authentication for the Node-RED server; it is not configured by default.
Node-RED server authentication = configured
Event History
Frequently Asked Questions
What is the severity of CVE-2025-41656?
CVE-2025-41656 is considered high severity due to the potential for unauthenticated remote command execution.
How do I fix CVE-2025-41656?
To fix CVE-2025-41656, ensure that authentication for the Node-RED server is properly configured and enabled.
What vulnerabilities does CVE-2025-41656 exploit?
CVE-2025-41656 exploits the lack of default authentication in Node-RED that allows remote command execution.
Who is affected by CVE-2025-41656?
All installations of Node-RED without authentication configuration are affected by CVE-2025-41656.
What should I do if my system is impacted by CVE-2025-41656?
If your system is impacted by CVE-2025-41656, immediately secure your Node-RED installation by implementing authentication.