Webfrontend CVE-2025-41705

Exploitation requires the attacker to hold a man-in-the-middle position on the network path between the client and the device's Webfrontend (adjacent/same-segment access, ARP/DNS spoofing, or a compromised network intermediary), AND a legitimate user must actively log in during the interception window (UI:R). The limiting factors are substantial: credentials are only exposed in transit, so the attacker cannot act in isolation and must time interception to a real login, and the AC:H rating reflects the non-trivial effort to establish and maintain the MITM channel on the websocket connection. Properly segmented networks or enforced transport encryption on the websocket channel materially reduce exploitability.

This is a moderate, conditional risk rather than an urgent priority. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N, base 6.8) tells a consistent story: network-reachable but with HIGH attack complexity because the attacker must first achieve a man-in-the-middle position on the websocket channel, and UI:R because a legitimate user must actually log in to the Webfrontend while the attacker is intercepting. The EPSS score of 0.46% (39th percentile) is low, reinforcing that mass, automated exploitation is unlikely - this is an opportunistic/targeted class of flaw, not a wormable one. There is no CISA KEV listing and no public exploit identified at time of analysis. The signals are internally consistent (no conflict between network vector and the MITM prerequisite, since AC:H already encodes the positioning requirement), so the headline risk is bounded by the difficulty of obtaining a MITM foothold - typically same-LAN, adjacent-network, or compromised-path access. Where the device is exposed on a flat or untrusted network segment, credential capture is realistic and the C:H/I:H impact (full credential theft enabling account takeover) is meaningful; on a properly segmented network the practical risk drops considerably.

An attacker who has gained a man-in-the-middle position on the network path (e.g., ARP spoofing on a shared LAN or a compromised intermediary) passively monitors the websocket traffic to the device's Webfrontend. When an operator logs in, the attacker intercepts the websocket messages carrying the login credentials and replays them to take over the account. No public exploit code is identified at time of analysis, so an attacker would need to craft the interception tooling themselves.