PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-41426 Vertiv CVE debrief

CVE-2025-41426 is a critical Vertiv advisory affecting Liebert RDU101 and Liebert IS-UNITY. CISA says the issue is a stack-based buffer overflow and that an attacker could exploit it to gain code execution on the device. The advisory assigns a CVSS v3.1 score of 9.8, indicating a high-risk condition for exposed OT/industrial deployments.

Vendor
Vertiv
Product
Liebert RDU101
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2025-05-20
Original CVE updated
2025-05-20
Advisory published
2025-05-20
Advisory updated
2025-05-20

Who should care

Organizations operating Vertiv Liebert RDU101 or Liebert IS-UNITY devices, especially industrial control and other OT environments that rely on these systems for monitoring or infrastructure management. Security teams responsible for internet-facing or otherwise reachable management devices should prioritize this advisory.

Technical summary

The advisory describes a stack-based buffer overflow in affected Vertiv products. The CVSS vector provided by the source is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates remote network attackability with no privileges required and no user interaction. Vertiv lists affected versions as Liebert RDU101 <= 1.9.0.0 and Liebert IS-UNITY <= 8.4.1.0, and provides fixed versions 1.9.1.2_0000001 and 8.4.3.1_00160 respectively.

Defensive priority

High. The combination of remote attack potential, no required privileges, and code execution impact makes this a priority patch for any reachable deployment.

Recommended defensive actions

  • Update Liebert RDU101 to v1.9.1.2_0000001.
  • Update Liebert IS-UNITY to v8.4.3.1_00160.
  • Inventory deployed Vertiv devices to confirm whether affected versions are present.
  • Restrict network exposure of management interfaces until updates are applied.
  • Follow Vertiv's security support guidance for product-specific remediation and coordination.

Evidence notes

All factual claims are drawn from the supplied CISA CSAF advisory source item for ICSA-25-140-10 / CVE-2025-41426 and its listed references. The source states the vulnerability is a stack-based buffer overflow, that exploitation could lead to code execution on the device, and that affected products and fixed versions are as listed in the advisory. Timing context uses the supplied published and modified dates of 2025-05-20T06:00:00.000Z.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-41426 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-41426

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-41426 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-41426

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2025/icsa-25-140-10.json

    cisa_csaf

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/news-events/ics-advisories/icsa-25-140-10

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/resources-tools/resources/ics-recommended-practices

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/topics/industrial-control-systems

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf

    Reference

  • Source reference

    Unverified legacy reference

    URL: https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B

    Reference

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.