CVE-2025-46414

EG4 Electronics EG4 Inverters Improper Restriction of Excessive Authentication Attempts

Description

The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attacker to gain unauthorized access using brute-force methods if they possess a valid device serial number. The API provides clear feedback when the correct PIN is entered. This vulnerability was patched in a server-side update on April 6, 2025.

Remediation

Workaround:

  • CVE-2025-46414 was fixed on April 6, 2025. No user action was or is necessary. For more information, contact EG4. https://eg4electronics.com/contact/ https://eg4electronics.com/contact/

Category

9.2
CVSS
Severity: Critical
CVSS 4.0 •
CVSS 3.1 •
EPSS 0.05%
Affected: EG4 Electronics EG4 12kPV
Affected: EG4 Electronics EG4 18kPV
Affected: EG4 Electronics EG4 Flex 21
Affected: EG4 Electronics EG4 Flex 18
Affected: EG4 Electronics EG4 6000XP
Affected: EG4 Electronics EG4 12000XP
Affected: EG4 Electronics EG4 GridBoss
Published at:
Updated at:

References

Link Tags
https://www.cisa.gov/news-events/ics-advisories/icsa-25-219-07
https://eg4electronics.com/contact/

Frequently Asked Questions

What is the severity of CVE-2025-46414?
CVE-2025-46414 has been scored as a critical severity vulnerability.
How to fix CVE-2025-46414?
As a workaround for remediating CVE-2025-46414: CVE-2025-46414 was fixed on April 6, 2025. No user action was or is necessary. For more information, contact EG4. https://eg4electronics.com/contact/ https://eg4electronics.com/contact/
Is CVE-2025-46414 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2025-46414 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-46414?
CVE-2025-46414 affects EG4 Electronics EG4 12kPV, EG4 Electronics EG4 18kPV, EG4 Electronics EG4 Flex 21, EG4 Electronics EG4 Flex 18, EG4 Electronics EG4 6000XP, EG4 Electronics EG4 12000XP, EG4 Electronics EG4 GridBoss.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.