CVE-2025-41710: FTP Server Auth Bypass Vulnerability

CVE-2025-41710 Overview

CVE-2025-41710 is a hardcoded credentials vulnerability that allows an unauthenticated remote attacker to gain unauthorized access to an FTP server. The vulnerability stems from the use of hardcoded credentials (CWE-798) embedded in the affected products, enabling attackers with network access to authenticate to a previously activated FTP server and obtain limited read and write privileges.

Critical Impact

Unauthenticated remote attackers can leverage hardcoded credentials to access the FTP server, potentially reading sensitive configuration data or writing malicious files to the system.

Affected Products

• Janitza devices (see CERT@VDE Advisory VDE-2025-079 for specific models)
• Weidmüller devices (see CERT@VDE Advisory VDE-2025-096 for specific models)

Discovery Timeline

• 2026-03-10 - CVE-2025-41710 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2025-41710

Vulnerability Analysis

This vulnerability is classified as CWE-798 (Use of Hard-coded Credentials), a configuration and design flaw where authentication credentials are embedded directly in the software or firmware. The presence of hardcoded credentials represents a fundamental security weakness because these credentials cannot be changed by administrators and, once discovered, can be exploited by any attacker with network access to the target system.

The vulnerability allows remote, unauthenticated attackers to authenticate to the FTP service using the hardcoded credentials. Once authenticated, attackers gain limited read and write access to the FTP server, which could enable them to exfiltrate sensitive configuration files, upload malicious payloads, or modify existing files depending on the specific permissions granted.

Root Cause

The root cause of this vulnerability is the improper practice of embedding static authentication credentials within the device firmware or software. This anti-pattern is particularly problematic in industrial control systems and IoT devices where firmware updates may be infrequent and credential rotation is not possible without vendor intervention. The hardcoded credentials persist across device reboots and cannot be changed by end users, creating a persistent attack surface.

Attack Vector

The attack is network-based and requires no user interaction or prior authentication. An attacker with network access to the target device's FTP service can exploit this vulnerability by:

1. Identifying devices running the vulnerable FTP service through network scanning
2. Using the publicly known hardcoded credentials to authenticate to the FTP server
3. Gaining limited read and write access to files accessible through the FTP service
4. Potentially exfiltrating sensitive data or uploading malicious files

The vulnerability is remotely exploitable from any network position that can reach the FTP port (typically TCP port 21) on the affected device. For technical implementation details, refer to the CERT@VDE Advisory VDE-2025-079 and CERT@VDE Advisory VDE-2025-096.

Detection Methods for CVE-2025-41710

Indicators of Compromise

• Unexpected FTP authentication events, particularly from external or untrusted IP addresses
• FTP login attempts using default or generic usernames that may correspond to hardcoded credentials
• Unusual file access patterns on the FTP server, including access to configuration files or system directories
• FTP connections from IP addresses not associated with legitimate administrative activity

Detection Strategies

• Monitor FTP authentication logs for successful logins from unknown or suspicious IP addresses
• Implement network intrusion detection rules to identify FTP traffic targeting potentially vulnerable devices
• Deploy honeypot FTP services configured with known hardcoded credentials to detect exploitation attempts
• Conduct regular asset inventory audits to identify devices running vulnerable firmware versions

Monitoring Recommendations

• Enable comprehensive logging on all FTP services and forward logs to a centralized SIEM platform
• Configure alerts for FTP authentication events occurring outside of normal maintenance windows
• Monitor network traffic for connections to FTP ports (TCP 21) on industrial control system devices
• Implement file integrity monitoring on directories accessible via FTP to detect unauthorized modifications

How to Mitigate CVE-2025-41710

Immediate Actions Required

• Disable the FTP service on affected devices if it is not required for operational purposes
• Implement network segmentation to restrict FTP access to authorized management networks only
• Deploy firewall rules to block FTP traffic from untrusted network segments
• Review vendor advisories for firmware updates that address the hardcoded credentials issue

Patch Information

Consult the vendor security advisories for patching guidance:

• CERT@VDE Advisory VDE-2025-079 (Janitza devices)
• CERT@VDE Advisory VDE-2025-096 (Weidmüller devices)
• Janitza CSAF Document
• Weidmüller CSAF Document

Contact the respective vendors (Janitza or Weidmüller) for updated firmware that removes or allows modification of the hardcoded credentials.

Workarounds

• Disable the FTP service entirely if not operationally required
• Implement strict network access controls to limit FTP connectivity to trusted management stations only
• Deploy a VPN or jump host architecture to ensure FTP access requires prior authentication through a secure channel
• Monitor and audit all FTP access attempts as an interim detection measure until patches are applied

# Example firewall rule to restrict FTP access (iptables)
# Allow FTP only from trusted management network 10.0.100.0/24
iptables -A INPUT -p tcp --dport 21 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 21 -j DROP