An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17.

published 2017-02-13 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-14254

cvss: 10.0; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.2%; EPSS 1.2% chance of exploitation in 30 days, percentile 69%
public exploits: 0; none known

An issue was discovered in Carlo Gavazzi VMU-C EM prior to firmware Version A11_U05, and VMU-C PV prior to firmware Version A17. Successful exploitation of this CROSS-SITE REQUEST FORGERY (CSRF) vulnerability can allow execution of unauthorized actions on the device such as configuration parameter changes, and saving modified configuration.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-17-012-03 updated 2017-01-12 cvss 10.0

Carlo Gavazzi VMU-C EM and VMU-C PV

Carlo Gavazzi VMU-C EM < A11_U05 Carlo Gavazzi VMU-C PV < A17
affected: vendor fix, mitigation “The relevant firmware versions are available either by means of the firmware update function embedded in the VMU-C or by downloading them from Carlo Gavazzi's web site. Please open the link:”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.25% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.0	10.0	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD	2.0	7.5	AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

n/a Carlo Gavazzi VMU-C EM and VMU-C PV

Classification

Weakness

CWE-352 Cross-Site Request Forgery

References

securityfocus.com /bid/95411
vdb-entry, third-party-advisory
ics-cert.us-cert.gov /advisories/ICSA-17-012-03
third-party-advisory, us-government-resource

Sources

CVE List CVE-2017-5145
NVD CVE-2017-5145

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary