CVE Alert: CVE-2025-41708 – Bender – CC612

Risk verdict

High risk: unauthenticated access over HTTP to the web interface enables cleartext transmission of sensitive data on the same network.

Why this matters

Cleartext data in transit can expose credentials, configuration details and potentially PII, creating significant regulatory and reputational risk. With multiple Bender products affected, an attacker on internal networks could harvest sensitive information across deployments, and misused data could facilitate broader intrusions.

Most likely attack path

An attacker on the same LAN can reach the HTTP admin UI without authentication. The absence of TLS means data is readable in transit, potentially allowing credential and config leakage. The attack relies on network access and does not require user interaction; lateral movement is not inherent, but data exfiltration or credential harvesting could enable further access.

Who is most exposed

Devices exposing web administration over HTTP are particularly vulnerable in on-premise or tightly scoped enterprise networks where management interfaces are reachable from user or maintenance subnets.

Detection ideas

• Monitor for HTTP requests to device management endpoints (port 80) from unexpected internal hosts.
• Look for plaintext credential or token exposure in captured traffic.
• Check logs for recurring unauthenticated access attempts to the web UI.
• Detect lack of TLS negotiation on management interfaces.
• IDS/IPS signatures for unusual HTTP access to network devices.

Mitigation and prioritisation

• Enable HTTPS on the web interface and require TLS (prefer TLS 1.2+ with strong ciphers).
• Disable HTTP management access or restrict to trusted management networks/VPNs.
• Enforce authentication on the UI; rotate and harden credentials; consider IP allowlisting.
• Apply vendor firmware/configuration updates that remove insecure defaults.
• Schedule controlled patching and test in a staging environment; implement network segmentation and monitoring as compensating controls.