CVE-2025-41723
Critical
Description
The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations.
SeverityCritical
CVSS9.8
Exploit probability—
Productmodulo 6 devices modu680-AS
PublishedOct 22, 2025
First seenOct 22, 2025
Weakness typeCWE-35CWE-35
How to fix
Update
- Sauter modulo 6 devices modu680-ASFirmware v3.2.0 or later
- Sauter modulo 6 devices modu660-ASFirmware v3.2.0 or later
- Sauter modulo 6 devices modu612-LCFirmware v3.2.0 or later
- Sauter EY-modulo 5 modu 5 modu524Firmware v6.0 or later
- Sauter EY-modulo 5 modu 5 modu525Firmware v6.0 or later
- Sauter EY-modulo 5 ecos 5 ecos504/505Firmware v6.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Sauter modulo 6 devices modu680-AS | v < Firmware v3.2.0 | Firmware v3.2.0 |
| Sauter modulo 6 devices modu660-AS | v < Firmware v3.2.0 | Firmware v3.2.0 |
| Sauter modulo 6 devices modu612-LC | v < Firmware v3.2.0 | Firmware v3.2.0 |
| Sauter EY-modulo 5 modu 5 modu524 | v < Firmware v6.0 | Firmware v6.0 |
| Sauter EY-modulo 5 modu 5 modu525 | v < Firmware v6.0 | Firmware v6.0 |
| Sauter EY-modulo 5 ecos 5 ecos504/505 | v < Firmware v6.0 | Firmware v6.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.