PT-2025-86: Disclosure of confidential data via controller configuration request in Fastwel PLC web server

Vulnerability vector:

• Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N
• Severity (CVSSv4.0): 8.3 (High)

Description:

The vulnerability was identified in Fastwel programmable controllers, versions 3.4.5.0 (CPM810-03), 3.4.9.1 (СPM723-01).

The discovered vulnerability can be exploited by an attacker to obtain administrator‑level privileges.

Vulnerability status: Confirmed by vendor

Date of vulnerability remediation: 10.09.2025

Recommendations:

Update to versions:

• CPM723-01 3.4.9.5
• CPM810-03 3.4.5.1

Additional information: 

• Secutiry advisory CPM723-01

• Security advisory CPM810-03

Researcher: Maksim Gruzin (Positive Technologies)