Vulnerabilidades de Sauter

🔔 Criar alerta RSS

CVEs publicadas que afetam produtos de Sauter: 6 registro(s), com severidade, exploração e correções.

modulo 6 devices modu680-AS 6 modulo 6 devices modu660-AS 6 modulo 6 devices modu612-LC 6 EY-modulo 5 modu 5 modu524 6 EY-modulo 5 modu 5 modu525 6 EY-modulo 5 ecos 5 ecos504/505 6

Somente exploradas (KEV) →

CVE-2025-41724 Alta · 7.5 CWE-239 22/10/2025

Sauter: Crash via Incomplete SOAP Request

An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests. The wscserver process will not be restarted by a watchdog and a device reboot is necessary to make it work again.

CVE-2025-41723 Crítica · 9.8 CWE-35 22/10/2025

Sauter: Directory Traversal in importFile SOAP Method

The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations.

CVE-2025-41722 Alta · 7.5 CWE-798 22/10/2025

Sauter: Hard-coded Authentication Credentials

The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices.

CVE-2025-41721 Baixa · 2.7 CWE-77 22/10/2025

Sauter: Command Injection

A high privileged remote attacker can influence the parameters passed to the openssl command due to improper neutralization of special elements when adding a password protected self-signed certificate.

CVE-2025-41720 Média · 4.3 CWE-646 22/10/2025

Sauter: Arbitrary File Upload

A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified.

CVE-2025-41719 Alta · 8.8 CWE-1286 22/10/2025

Sauter: Improper Validation of user-controlled data

A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters which leads to deletion of all previously configured users and the creation of the default Administrator with a known default password.