CVE-2025-41722
High
Description
The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices.
SeverityHigh
CVSS7.5
Exploit probability—
Productmodulo 6 devices modu680-AS
PublishedOct 22, 2025
First seenOct 22, 2025
Weakness typeCWE-798Hard-coded credentials
How to fix
Update
- Sauter modulo 6 devices modu680-ASFirmware v3.2.0 or later
- Sauter modulo 6 devices modu660-ASFirmware v3.2.0 or later
- Sauter modulo 6 devices modu612-LCFirmware v3.2.0 or later
- Sauter EY-modulo 5 modu 5 modu524Firmware v6.0 or later
- Sauter EY-modulo 5 modu 5 modu525Firmware v6.0 or later
- Sauter EY-modulo 5 ecos 5 ecos504/505Firmware v6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Sauter modulo 6 devices modu680-AS | v < Firmware v3.2.0 | Firmware v3.2.0 |
| Sauter modulo 6 devices modu660-AS | v < Firmware v3.2.0 | Firmware v3.2.0 |
| Sauter modulo 6 devices modu612-LC | v < Firmware v3.2.0 | Firmware v3.2.0 |
| Sauter EY-modulo 5 modu 5 modu524 | v < Firmware v6.0 | Firmware v6.0 |
| Sauter EY-modulo 5 modu 5 modu525 | v < Firmware v6.0 | Firmware v6.0 |
| Sauter EY-modulo 5 ecos 5 ecos504/505 | v < Firmware v6.0 | Firmware v6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.