CVE-2025-1235 - Vulnerability Details - OpenCVE

A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0005.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://cert.vde.com/en/advisories/VDE-2025-020

History

Mon, 02 Jun 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 02 Jun 2025 06:30:00 +0000

Type	Values Removed	Values Added
Description		A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970.
Title		WAGO: Switches affected by year 2k38 problem
Weaknesses		CWE-190
References		https://cert.vde.com/en/advisories/VDE-2025-020
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: CERTVDE

Published: 2025-06-02T06:23:19.261Z

Updated: 2025-06-02T17:03:08.740Z

Reserved: 2025-02-11T15:46:42.856Z

Link: CVE-2025-1235

Vulnrichment

Updated: 2025-06-02T17:02:32.337Z

NVD

Status : Awaiting Analysis

Published: 2025-06-02T07:15:21.450

Modified: 2025-06-02T17:32:17.397

Link: CVE-2025-1235

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-1235", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "state": "PUBLISHED", "assignerShortName": "CERTVDE", "dateReserved": "2025-02-11T15:46:42.856Z", "datePublished": "2025-06-02T06:23:19.261Z", "dateUpdated": "2025-06-02T17:03:08.740Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Fully Managed Switches 0852-0303", "vendor": "WAGO", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "Fully Managed Switches 0852-1305", "vendor": "WAGO", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "Fully Managed Switches 0852-1305/0000-0001", "vendor": "WAGO", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "Fully Managed Switches 0852-1505", "vendor": "WAGO", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "Fully Managed Switches 0852-1505/0000-0001", "vendor": "WAGO", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "Lean Managed Switches 0852-1812", "vendor": "WAGO", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "Lean Managed Switches 0852-1812/0010-0000", "vendor": "WAGO", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "Lean Managed Switches 0852-1813", "vendor": "WAGO", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "Lean Managed Switches 0852-1813/0000-0001", "vendor": "WAGO", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "Lean Managed Switches 0852-1813/0010-0000", "vendor": "WAGO", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "Lean Managed Switches 0852-1813/0010-0001", "vendor": "WAGO", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "Lean Managed Switches 0852-1816", "vendor": "WAGO", "versions": [{"status": "affected", "version": "all"}]}, {"defaultStatus": "unaffected", "product": "Lean Managed Switches 0852-1816/0010-0000", "vendor": "WAGO", "versions": [{"status": "affected", "version": "all"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Marcus Kramh\u00f6ller from Noris Automatio GmbH"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970."}], "value": "A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-06-02T06:23:19.261Z"}, "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2025-020"}], "source": {"advisory": "VDE-2025-020", "defect": ["CERT@VDE#641749"], "discovery": "UNKNOWN"}, "title": "WAGO: Switches affected by year 2k38 problem", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-06-02T17:02:26.990253Z", "id": "CVE-2025-1235", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-02T17:03:08.740Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1235", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-06-02T17:02:26.990253Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-06-02T17:02:32.337Z"}}], "cna": {"title": "WAGO: Switches affected by year 2k38 problem", "source": {"defect": ["CERT@VDE#641749"], "advisory": "VDE-2025-020", "discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Marcus Kramh\u00f6ller from Noris Automatio GmbH"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WAGO", "product": "Fully Managed Switches 0852-0303", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "Fully Managed Switches 0852-1305", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "Fully Managed Switches 0852-1305/0000-0001", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "Fully Managed Switches 0852-1505", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "Fully Managed Switches 0852-1505/0000-0001", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "Lean Managed Switches 0852-1812", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "Lean Managed Switches 0852-1812/0010-0000", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "Lean Managed Switches 0852-1813", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "Lean Managed Switches 0852-1813/0000-0001", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "Lean Managed Switches 0852-1813/0010-0000", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "Lean Managed Switches 0852-1813/0010-0001", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "Lean Managed Switches 0852-1816", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}, {"vendor": "WAGO", "product": "Lean Managed Switches 0852-1816/0010-0000", "versions": [{"status": "affected", "version": "all"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://cert.vde.com/en/advisories/VDE-2025-020"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970.", "supportingMedia": [{"type": "text/html", "value": "A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the switch to be set back to January 1st, 1970.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "CWE-190 Integer Overflow or Wraparound"}]}], "providerMetadata": {"orgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "shortName": "CERTVDE", "dateUpdated": "2025-06-02T06:23:19.261Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1235", "state": "PUBLISHED", "dateUpdated": "2025-06-02T17:03:08.740Z", "dateReserved": "2025-02-11T15:46:42.856Z", "assignerOrgId": "270ccfa6-a436-4e77-922e-914ec3a9685c", "datePublished": "2025-06-02T06:23:19.261Z", "assignerShortName": "CERTVDE"}, "dataVersion": "5.1"}