Summary
Vulnerabilities have been discovered in the embedded firmware of SAUTER modulo 6 devices. These vulnerabilities affect the embedded web server as well as the interface to the SAUTER CASE Suite tools.
Details
Remediation
Update to firmware version 3.2.0. or newer. This will require CASE Suite Version 5.2 SR5 or newer. Contact your local SAUTER representative for support.
Impact
The vulnerabilities in the modulo 6 devices allow privilege escalation, remote exploitation, and compromise of device integrity, availability and confidentiality.
Vulnerabilities 6
-
Critical 9.8
Sauter: Directory Traversal in importFile SOAP Method
The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations.
-
High 8.8
Sauter: Improper Validation of user-controlled data
A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters which leads to deletion of all previously configured users and the creation of the default Administrator with a known defaul…
-
High 7.5
Sauter: Hard-coded Authentication Credentials
The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices.
-
High 7.5
Sauter: Crash via Incomplete SOAP Request
An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests. The wscserver process will not be restarted by a watchdog and a device reboot is necessary to make it work again.
-
Medium 4.3
Sauter: Arbitrary File Upload
A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified.
-
Low 2.7
Sauter: Command Injection
A high privileged remote attacker can influence the parameters passed to the openssl command due to improper neutralization of special elements when adding a password protected self-signed certificate.
Revision history
-
#1.1.0
Correction: modu524 and modu525 not affected by CVE-2025-41723
-
#1.0.0
Initial revision
References
-
Sauter advisory overview at CERT@VDE
https://certvde.com/de/advisories/vendor/sauter/
-
VDE-2025-060: Sauter: Multiple vulnerabilities in SAUTER modulo 6 - HTML
https://certvde.com/en/advisories/VDE-2025-060