CVE-2023-25556
A CWE-287: Improper Authentication vulnerability exists that could allow a device to be...
A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the attacker has access to the KNX installation.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the attacker has access to the KNX installation.
- Record
CVE-2023-25556- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2023-29508
A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the attacker has access to the KNX installation.
- Record
EUVD-2023-29508- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q53x-4f23-hq3j
A CWE-287: Improper Authentication vulnerability exists that could allow a device to be...
A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the attacker has access to the KNX installation.
- Record
GHSA-q53x-4f23-hq3j- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
NVD
A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is entered and the attacker has access to the KNX installation.
- Record
CVE-2023-25556- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H - CVSS 3.1
- 8.8 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
- schneider electric merten instabus tastermodul 1fach system m 625199
- schneider electric merten instabus tastermodul 2fach system m 625299
- schneider electric merten jalousie-/schaltaktor reg-k/8x/16x/10 m. hb 649908
- schneider electric merten knx argus 180/2,20m up system 631725
- schneider electric merten knx schaltakt.2x6a up m.2 eing. meg6003-0002
- schneider electric merten knx uni-dimmaktor ll reg-k/2x230/300 w meg6710-0002
- schneider electric merten tasterschnittstelle 4fach plus 670804
- schneider-electric merten instabus tastermodul 1fach system m firmware
- schneider-electric merten instabus tastermodul 2fach system m firmware
- schneider-electric merten jalousie-\/schaltaktor reg-k\/8x\/16x\/10 m. hb firmware
- schneider-electric merten knx argus 180\/2\,20m up system firmware
- schneider-electric merten knx schaltakt.2x6a up m.2 eing. firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-25556 is a high vulnerability (CVSS 8.3) in Schneider Electric Merten Instabus Tastermodul 1fach System M 625199, published April 18, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 29th percentile. No source names a fixed version.