CVE-2025-13406 PUBLISHED

Scanning for higher HART revision device leads into NULL pointer dereference in live list

Assigner: Softing
Reserved: 19.11.2025 Published: 17.03.2026 Updated: 17.03.2026

NULL Pointer Dereference vulnerability in Softing Industrial Automation GmbH smartLink SW-HT (Webserver modules) allows HTTP DoS.This issue affects smartLink SW-HT: 1.43.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/AU:Y/R:A/RE:L/U:Red
CVSS Score: 6.8

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	None	Confidentiality	None
Attack Complexity	Low	Integrity	None	Integrity	None
Attack Requirements	Present	Availability	High	Availability	High
Privileges Required	High
User Interaction	Active

CVSS 4.0

Product Status

Vendor	Softing
Product	smartLink SW-HT
Versions	Default: unaffected Version 1.43 is affected Version 1.43.1 is unaffected

Solutions

Update smartLink SW-HT to patch V1.43.1 firmware.

References

Problem Types

CWE-476 NULL Pointer Dereference CWE

Impacts

CAPEC-469 HTTP DoS