CVE-2025-41438

The CS5000 Fire Panel is vulnerable due to a default account that exists on the panel. Even though it is possible to change this by SSHing into the device, it has remained unchanged on every installed system observed. This account is not root but holds high-level permissions that could severely impact the device's operation if exploited.

• CWE-1188

• https://www.cisa.gov/news-events/ics-advisories/icsa-25-148-03
• https://www.consiliumsafety.com/en/support/

Published

May 30, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-41430When BIG-IP SSL Orchestrator is enabled, undisclosed traffic…8.7
• CVE-2025-41431When connection mirroring is configured on a virtual server,…8.7
• CVE-2025-41432in OpenHarmony v5.1.0 and prior versions allow a local attac…7.8
• CVE-2025-41433When a Session Initiation Protocol (SIP) message routing fra…8.7
• CVE-2025-41436Mattermost versions <11.0 fail to properly enforce the "Allo…4.3
• CVE-2025-41437Zohocorp ManageEngine OpManager, NetFlow Analyzer, Network C…4.3
• CVE-2025-41439A reflected cross-site scripting vulnerability via a specifi…6.1
• CVE-2025-4144PKCE was implemented in the OAuth implementation in workers-…9.8
• CVE-2025-41441Mailform Pro CGI prior to 4.3.4 generates error messages con…5.3
• CVE-2025-41442A vulnerability exists in Advantech iView versions prior to …5.4
• CVE-2025-41443Mattermost versions 10.5.x <= 10.5.12, 10.11.x <= 10.11.2 fa…4.3
• CVE-2025-41444Zohocorp ManageEngine ADAudit Plus versions 8510 and prior a…8.3