Sauter: Hard-coded Authentication Credentials
Priority LOW 38CWE-798Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.
Summary
The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0027 19th percentileScored 2026-11-07
Fix Fixed modulo 6 devices modu680-AS (Sauter): Firmware v3.2.0modulo 6 devices modu660-AS (Sauter): Firmware v3.2.0+4 more products
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Sauter | modulo 6 devices modu680-AS | 0.0.0 to before Firmware v3.2.0 | Firmware v3.2.0 | Patch available | CNA |
| Sauter | modulo 6 devices modu660-AS | 0.0.0 to before Firmware v3.2.0 | Firmware v3.2.0 | Patch available | CNA |
| Sauter | modulo 6 devices modu612-LC | 0.0.0 to before Firmware v3.2.0 | Firmware v3.2.0 | Patch available | CNA |
| Sauter | EY-modulo 5 modu 5 modu524 | 0.0 to before Firmware v6.0 | Firmware v6.0 | Patch available | CNA |
| Sauter | EY-modulo 5 modu 5 modu525 | 0.0 to before Firmware v6.0 | Firmware v6.0 | Patch available | CNA |
| Sauter | EY-modulo 5 ecos 5 ecos504/505 | 0.0 to before Firmware v6.0 | Firmware v6.0 | Patch available | CNA |
- modulo 6 devices modu680-AS VendorSauter Affected 0.0.0 to before Firmware v3.2.0 Fixed in Firmware v3.2.0 Patch available CNA
- modulo 6 devices modu660-AS VendorSauter Affected 0.0.0 to before Firmware v3.2.0 Fixed in Firmware v3.2.0 Patch available CNA
- modulo 6 devices modu612-LC VendorSauter Affected 0.0.0 to before Firmware v3.2.0 Fixed in Firmware v3.2.0 Patch available CNA
- EY-modulo 5 modu 5 modu524 VendorSauter Affected 0.0 to before Firmware v6.0 Fixed in Firmware v6.0 Patch available CNA
- EY-modulo 5 modu 5 modu525 VendorSauter Affected 0.0 to before Firmware v6.0 Fixed in Firmware v6.0 Patch available CNA
- EY-modulo 5 ecos 5 ecos504/505 VendorSauter Affected 0.0 to before Firmware v6.0 Fixed in Firmware v6.0 Patch available CNA
Remediation
- Fix · CNA modulo 6 devices modu680-AS (Sauter) Fixed in Firmware v3.2.0
- Fix · CNA modulo 6 devices modu660-AS (Sauter) Fixed in Firmware v3.2.0
- Fix · CNA modulo 6 devices modu612-LC (Sauter) Fixed in Firmware v3.2.0
- Fix · CNA EY-modulo 5 modu 5 modu524 (Sauter) Fixed in Firmware v6.0
- Fix · CNA EY-modulo 5 modu 5 modu525 (Sauter) Fixed in Firmware v6.0
- Fix · CNA EY-modulo 5 ecos 5 ecos504/505 (Sauter) Fixed in Firmware v6.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Sauter EY-modulo 5 ecos 5 ecos504/505, EY-modulo 5 modu 5 modu524 and 4 more products Firmware v3.2.0, Firmware v6.0
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2025-27686 Sauter: Directory Traversal in importFile SOAP MethodPriority MEDIUM 52
- TI-2025-27682 Sauter: Improper Validation of user-controlled dataPriority LOW 39
- TI-2025-27687 Sauter: Crash via Incomplete SOAP RequestPriority LOW 33
Timeline
- 2026-10-02 Threatist record created from CVE-2025-41722
- 2026-10-03 Alias added: GHSA-p5c4-4hc3-4fp5
More Sauter vulnerabilities
- TI-2025-27686 Sauter: Directory Traversal in importFile SOAP Method CVSS 3.1CRITICAL 9.8
- TI-2026-54484 TOCTOU Vulnerability in file exchange CVSS 4.0CRITICAL 9.3
- TI-2015-06584 Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 sends cleartext credentials, which allows… CVSS 3.0CRITICAL 9.8
- TI-2015-06583 Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote attackers to bypass… CVSS 3.0HIGH 8.1
- TI-2025-27682 Sauter: Improper Validation of user-controlled data CVSS 3.1HIGH 8.8
- TI-2025-27687 Sauter: Crash via Incomplete SOAP Request CVSS 3.1HIGH 7.5
Sources
- CVE-2025-41722 · CVE Program
- CVE-2025-41722 · NVD
- FIRST EPSS
- GHSA-p5c4-4hc3-4fp5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences