Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Krebs on Security

Palo Alto Unit 42

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injection as root. This results in a total loss of confidentiality, availability and integrity due to improper control of code generation ('Code Injection’).

CVE-2025-41717 is a vulnerability classified under CWE-94 (Improper Control of Generation of Code) found in the Phoenix Contact TC ROUTER 3002T-3G. The flaw allows an unauthenticated remote attacker to exploit the config-upload endpoint by tricking a high privileged user into uploading a malicious configuration payload. This payload, when processed by the device, results in arbitrary code execution with root privileges. The vulnerability arises because the device does not properly validate or sanitize the uploaded configuration data, enabling code injection. The attack vector is network-based (AV:N), requires no privileges (PR:N), but does require user interaction (UI:R), such as convincing an authorized user to perform the upload. The scope is unchanged (S:U), meaning the impact is confined to the vulnerable component. The consequences are severe, with complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). This could lead to unauthorized control over the router, interception or manipulation of network traffic, disruption of network services, and potential pivoting into industrial control systems connected to the router. The vulnerability was publicly disclosed in January 2026, with no patches currently available. Although no exploits are known in the wild, the ease of exploitation and high impact make this a critical threat. The affected product is widely used in industrial and critical infrastructure environments, increasing the risk profile for organizations relying on this hardware.

Detailed information about CVE-2025-41717: CWE-94 Improper Control of Generation of Code ('Code Injection') in Phoenix Contact TC ROUTER 3002T-3G affecting Phoe

CVE-2025-41717: CWE-94 Improper Control of Generation of Code ('Code Injection') in Phoenix Contact TC ROUTER 3002T-3G - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2025-41717: CWE-94 Improper Control of Generation of Code ('Code Injection') in Phoenix Contact TC ROUTER 3002T-3G

Threats Tagged 'cve-2025-41717'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cve-2025-41717'

Lead Pen Test Professional