Act today Critical Known exploited Patch available CVSS up to 9.8 (NVD)
Bender fixes two exploited Linux kernel flaws in EDGE500IP
CERT@VDE advisoriesBender, EDGE500IP, COMTRAXX · energyCVE-2025-39682, CVE-2025-39964
What happened. Bender says two Linux kernel flaws (CVE-2025-39682 and CVE-2025-39964) affect the EDGE500IP. CISA lists both as known exploited. Bender says electrical safety is not affected and exploitation needs code execution on the device. The fix is in COMTRAXX firmware 5.1.1.
Who is affected. Users of the Bender EDGE500IP running COMTRAXX firmware before 5.1.1. The source names no specific organisations.
What to do. Update the Bender EDGE500IP to COMTRAXX firmware 5.1.1. Check which firmware version each device runs.
When to act. Act today: Bender EDGE500IP operators: listed as known exploited, so apply COMTRAXX 5.1.1 now.
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3
- L2
Why: The EDGE500IP is a gateway device that collects and passes on data from Bender monitoring equipment, so it sits at the supervisory and site operations levels. This is inferred, as the report
- Are you exposed?
Check the asset inventory for Bender EDGE500IP devices and compare their COMTRAXX firmware version with 5.1.1.
- If you cannot fix it yet
- Restrict network access to the EDGE500IP to known management hosts only.
- Keep the device off the internet and behind an OT firewall until the firmware is updated.
- Watch for
- Unexpected logons or new processes on the EDGE500IP, since exploitation needs code execution on the device.
- Connections to the device from hosts that do not normally manage it.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.