CVE-2025-41438 Consilium Safety CVE debrief

Who should care

Organizations operating CS5000 Fire Panel deployments, especially OT/ICS asset owners, fire safety system administrators, integrators, and local Consilium Safety support teams responsible for patching and configuration control.

Technical summary

The advisory identifies a default account on the CS5000 Fire Panel that is not root but has high-level permissions. Affected products are listed as Consilium Safety CS5000 Fire Panel versions earlier than R1.17.1. In Update A, CISA revised the CVSS vector from AV:N to AV:L and noted that Consilium software version R1.17.1 is available. The issue is therefore best treated as a privileged-account exposure that requires version control, configuration review, and OT-aware remediation.

Defensive priority

High — prioritize any CS5000 Fire Panel deployment running versions earlier than R1.17.1.

Recommended defensive actions

• Inventory all CS5000 Fire Panel deployments and confirm whether any systems are running versions earlier than R1.17.1.
• Obtain and apply Consilium Safety software version R1.17.1 through the local Consilium representative or support office, as the update is not publicly downloadable.
• Verify that the default account has been remediated according to vendor guidance after upgrading, and document the change in asset records.
• Restrict physical access, administrative access, and SSH access to dedicated personnel only, consistent with OT access-control practices.
• Request and apply the security configuration and hardening guidance that accompanies R1.17.1.
• If stronger built-in security is required, evaluate migration to Consilium Safety's newer fire panel line manufactured after July 1, 2024.

Evidence notes

The supplied CISA CSAF source states that the CS5000 Fire Panel is vulnerable because a default account exists on the panel, that it can be changed via SSH, and that it remained unchanged on every installed system observed. The affected product is listed as Consilium Safety CS5000 Fire Panel < R1.17.1. Revision history in Update A says Consilium software version R1.17.1 is now available and that the CVSS vector and score were updated, including a change from AV:N to AV:L. The supplied corpus does not include a CISA KEV entry for this CVE.

Official resources