CVE-2025-41426: Vertiv Liebert UPS Network Card Stack Buffer Overflow

CVE-2025-41426 is a stack-based buffer overflow (CWE-121) in the web server of Vertiv's Liebert RDU101 and Liebert IS-UNITY communication cards, the network interface hardware that lets Vertiv's Liebert UPS line be monitored and managed remotely, and researchers showed it can be exploited over the network with no authentication to achieve remote code execution on the card; CISA's ICS-CERT recorded a vendor-submitted score of 9.8 (critical) on the CVSS v3.1 scale, but NVD has not yet published its own Primary score.

CVE-2025-41426 (CWE-121, stack-based buffer overflow) affects the web interface of Vertiv's Liebert RDU101 and Liebert IS-UNITY communication/network cards — the accessory cards that give Vertiv's Liebert line of uninterruptible power supplies a network-manageable interface. NVD's description states: "Affected Vertiv products contain a stack based buffer overflow vulnerability. An attacker could exploit this vulnerability to gain code execution on the device" (NVD).

CISA published ICSA-25-140-10 on 2025-05-20, covering CVE-2025-41426 together with a companion authentication-bypass flaw, CVE-2025-46412 (CWE-288), which the advisory describes as affected products failing to "properly protect webserver functions that could allow an attacker to bypass authentication." Both were reported by Vera Mens of Claroty Team82, whose own research write-up explains that three strings — the HTTP method, the URI request and a session-activity value — are copied into a fixed-size stack buffer, and that because the URI and session value are length-checked but the HTTP method string is not, an attacker can overflow the buffer by sending an oversized HTTP method token to trigger memory corruption and code execution (CISA ICS Advisory ICSA-25-140-10).

NVD tracks CVE-2025-41426 with status "Deferred": it records only an ICS-CERT-submitted score (source [email protected]) — CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — typed Secondary, not NVD's own Primary rating, so this page does not show a headline severity score rather than presenting that figure as NVD-confirmed (NVD). Vertiv's own security support center lists the advisory as well (Vertiv Security Support Center).

CISA states that "no known public exploitation specifically targeting these vulnerabilities has been reported to CISA at this time," and recommends minimising network exposure for these cards, isolating UPS management networks behind firewalls, and using a VPN for any remote access. CVE-2025-41426 is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.00778 (56.1st percentile) as of 2026-11-07 (CISA KEV, FIRST EPSS).

NVD has not yet analysed this CVE. In the meantime, operators running Liebert RDU101 1.9.0.0 or earlier, or Liebert IS-UNITY 8.4.1.0 or earlier, should update to RDU101 v1.9.1.2_0000001 or IS-UNITY v8.4.3.1_00160 and keep these UPS communication cards off any network reachable from the internet.

• Affected Vertiv products contain a stack based buffer overflow vulnerability. An attacker could exploit this vulnerability to gain code execution on the device. — NVD
• ICSA-25-140-10 covers Liebert RDU101 (<=1.9.0.0) and Liebert IS-UNITY (<=8.4.1.0), bundled with authentication-bypass CVE-2025-46412; reported by Vera Mens of Claroty Team82; fixed in RDU101 v1.9.1.2_0000001 and IS-UNITY v8.4.3.1_00160; no known public exploitation reported to CISA. — CISA ICS Advisory ICSA-25-140-10
• NVD status 'Deferred'; records only an ICS-CERT-submitted Secondary CVSS v3.1 score of 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; no NVD-published Primary score as of this review. — NVD
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.00778 (56.1st percentile) as of 2026-11-07. — FIRST EPSS