CVE-2025-11043

critical · 9.1

An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an unauthenticated attacker on the network to position themselves to intercept and interfere with data exchanges.

9.1

CVSS

0.2%

EPSS (exploit prob.)

14th

EPSS percentile

2026-01-19

Published

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-295

References

https://www.br-automation.com/fileadmin/SA25P004-4f45197f.pdf

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-11043