CVE-2025-41722

Sauter: Hard-coded Authentication Credentials

State: Published
Severity: 7.5 High
Published: Oct 22, 2025
Updated: Oct 22, 2025
Reserved: Apr 16, 2025

Description

The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CERTVDE

Weaknesses

CWE-798 Use of Hard-coded Credentials

Affected Products

Product	Versions
modulo 6 devices modu680-ASSauter	0.0.0 to before Firmware v3.2.0Affected
modulo 6 devices modu660-ASSauter	0.0.0 to before Firmware v3.2.0Affected
modulo 6 devices modu612-LCSauter	0.0.0 to before Firmware v3.2.0Affected
EY-modulo 5 modu 5 modu524Sauter	0.0 to before Firmware v6.0Affected
EY-modulo 5 modu 5 modu525Sauter	0.0 to before Firmware v6.0Affected
EY-modulo 5 ecos 5 ecos504/505Sauter	0.0 to before Firmware v6.0Affected

References

https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-060.json

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.