CVE-2025-41722

HIGH

Sauter modulo 6 and EY-modulo 5 - Use of Hard-coded Credentials in wsc Server

Title source: llm

Description

The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices.

References (1)

Core 1

Core References

Various Sources

https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-060.json

Scores

CVSS v3 7.5

EPSS 0.0023

EPSS Percentile 13.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact partial

Details

CWE

CWE-798

Status published

Products (6)

Sauter/EY-modulo 5 ecos 5 ecos504/505 0.0 - Firmware v6.0

Sauter/EY-modulo 5 modu 5 modu524 0.0 - Firmware v6.0

Sauter/EY-modulo 5 modu 5 modu525 0.0 - Firmware v6.0

Sauter/modulo 6 devices modu612-LC 0.0.0 - Firmware v3.2.0

Sauter/modulo 6 devices modu660-AS 0.0.0 - Firmware v3.2.0

Sauter/modulo 6 devices modu680-AS 0.0.0 - Firmware v3.2.0

Published Oct 22, 2025

Tracked Since Feb 18, 2026