CVE-2025-41361 Overview
CVE-2025-41361 is an uncontrolled resource consumption vulnerability [CWE-400] affecting ZIV IDF version v0.10.0-0C03-03 and ZLF version v0.10.0-0C03-04. The devices improperly handle Transport Layer Security (TLS) requests directed at PROCOME sockets. An attacker can send crafted TLS requests to active PROCOME ports and force the device to reboot, producing a denial of service (DoS) condition.
Critical Impact
A remote, unauthenticated attacker with network access to a configured PROCOME port can trigger device reboots, interrupting industrial control communications protected by encryption.
Affected Products
- ZIV IDF firmware v0.10.0-0C03-03
- ZIV ZLF firmware v0.10.0-0C03-04
- Deployments where PROCOME ports are configured, active, and using encrypted communications
Discovery Timeline
- 2025-06-06 - CVE-2025-41361 published to the National Vulnerability Database (NVD)
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-41361
Vulnerability Analysis
The flaw resides in how the IDF and ZLF firmware processes inbound TLS handshakes bound for PROCOME sockets. PROCOME is a proprietary protocol used by ZIV protection and control devices in electrical substations. When TLS encryption is enabled on a PROCOME port, the firmware fails to constrain resource allocation while parsing handshake messages.
The condition is classified under [CWE-400] (Uncontrolled Resource Consumption). Sending TLS requests to those ports exhausts internal resources and triggers a device reboot. Because PROCOME ports operate in substation automation environments, repeated reboots interrupt protection and telemetry traffic.
The attack does not require authentication. The attacker only needs network reachability to a PROCOME listener that has encryption active. Successful exploitation impacts availability without altering confidentiality or integrity on the device.
Root Cause
The firmware does not bound the resources consumed by TLS processing on PROCOME sockets. Malformed or volume-driven TLS messages drive the device into a failure state that resolves only through reboot, satisfying the conditions of [CWE-400].
Attack Vector
Exploitation occurs over the network. The attacker transmits TLS requests to a configured and active PROCOME port. No user interaction or credentials are required, but the deployment must have PROCOME ports enabled with encryption turned on. Refer to the INCIBE Security Notice for vendor-specific technical context.
No verified proof-of-concept code is publicly available for CVE-2025-41361.
See the INCIBE advisory for additional technical details.
Detection Methods for CVE-2025-41361
Indicators of Compromise
- Unexpected reboots of ZIV IDF or ZLF devices coinciding with inbound TLS traffic to PROCOME ports
- Loss of PROCOME telemetry or protection signaling immediately after TLS handshake activity from unfamiliar source addresses
- Repeated TLS ClientHello messages from a single external host directed at PROCOME listener ports
Detection Strategies
- Capture and inspect network traffic to PROCOME ports for TLS handshake anomalies, including malformed or high-frequency ClientHello records
- Correlate device watchdog and restart events with packet captures from the operational technology (OT) network
- Alert on TLS sessions to PROCOME ports originating from sources outside the engineering and SCADA allowlist
Monitoring Recommendations
- Forward device syslog, restart events, and protocol gateway logs into a centralized analytics platform for correlation
- Establish baselines for normal PROCOME TLS handshake rates and alert on deviations
- Monitor north-south and east-west OT traffic for unauthorized clients attempting TLS handshakes against substation equipment
How to Mitigate CVE-2025-41361
Immediate Actions Required
- Identify all ZIV IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04 devices and confirm whether PROCOME ports are configured with encryption active
- Restrict network reachability to PROCOME ports to known engineering workstations and SCADA front-end processors using firewall or ACL rules
- Engage ZIV support to confirm availability of remediated firmware and apply it during the next maintenance window
Patch Information
No public patch identifier is listed in the NVD record at the time of writing. Operators should consult ZIV directly and review the INCIBE Security Notice for updates on remediated firmware versions.
Workarounds
- Disable TLS encryption on PROCOME ports where operationally acceptable, since the vulnerability requires encryption to be active
- Place affected devices behind a segmented OT firewall that terminates or filters TLS traffic before it reaches the device
- Limit PROCOME exposure to a dedicated management VLAN and block all inbound TLS from untrusted segments
# Example firewall restriction limiting PROCOME TLS access to a trusted SCADA subnet
# Replace PROCOME_PORT, DEVICE_IP, and SCADA_SUBNET with environment-specific values
iptables -A INPUT -p tcp --dport PROCOME_PORT -s SCADA_SUBNET -d DEVICE_IP -j ACCEPT
iptables -A INPUT -p tcp --dport PROCOME_PORT -d DEVICE_IP -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
