CVE-2025-46352: Consilium Safety CS5000 Fire Panel Use of Hard-coded Credentials

Published May 29, 2025

Updated

The CS5000 Fire Panel is vulnerable due to a hard-coded password that runs on a VNC server and is visible as a string in the binary responsible for running VNC. This password cannot be altered, allowing anyone with knowledge of it to gain remote access to the panel. Such access could enable an attacker to operate the panel remotely, potentially putting the fire panel into a non-functional state and causing serious safety issues.

Affected Software

2 affected components

: Consilium Safety CS5000 Fire Panel

Consilium Safety CS5000 Fire Panel

Remediation

Information

Users wanting enhanced security features are advised to upgrade to Consilium Safety's newer line of fire panels. Specifically, products manufactured after July 1, 2024, incorporate more secure-by-design principles. More product safety information can be found on Consilium Safety's support webpage https://www.consiliumsafety.com/en/support/ .

Event History

May 29, 2025

CVE Published

via MITRE·11:18 PM

Data Sourced

via MITRE·11:18 PM

RemedyDescriptionSeverityWeakness

May 30, 2025

Data Sourced

via NVD·12:15 AM

DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

ICSA-25-148-03

Frequently Asked Questions

What is the severity of CVE-2025-46352?

CVE-2025-46352 is considered a high severity vulnerability due to the potential for unauthorized remote access.

How do I fix CVE-2025-46352?

Fixing CVE-2025-46352 involves replacing the CS5000 Fire Panel with a version that does not use hard-coded passwords.

What systems are affected by CVE-2025-46352?

CVE-2025-46352 affects the Consilium Safety CS5000 Fire Panel.

Can CVE-2025-46352 allow for exploitation?

Yes, CVE-2025-46352 allows for exploitation through the hard-coded password providing unauthorized access to the fire panel.

Is there a mitigation strategy for CVE-2025-46352?

Currently, there is no direct mitigation strategy for CVE-2025-46352 other than replacing the vulnerable hardware.