Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 6

Export CSV
CVE-2025-41719

Sauter: Improper Validation of user-controlled data

A low privileged remote attacker can corrupt the webserver users storage on the device by setting a sequence of unsupported characters which leads to deletion of all previously configured users and the creation of the default Administrator with a known default password.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Sauter
Products
Ey-modulo 5 Devices Modulo 6 Devices Webserver
CVE-2025-41720

Sauter: Arbitrary File Upload

A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Sauter
Products
Ey-modulo 5 Devices Modulo 6 Devices
CVE-2025-41721

Sauter: Command Injection

A high privileged remote attacker can influence the parameters passed to the openssl command due to improper neutralization of special elements when adding a password protected self-signed certificate.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed
Vendors
Sauter
Products
Ey-modulo 5 Devices Modulo 6 Devices
CVE-2025-41722

Sauter: Hard-coded Authentication Credentials

The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Sauter
Products
Ey-modulo 5 Devices Modulo 6 Devices
CVE-2025-41723

Sauter: Directory Traversal in importFile SOAP Method

The importFile SOAP method is vulnerable to a directory traversal attack. An unauthenticated remote attacker bypass the path restriction and upload files to arbitrary locations.

CVSS 3.1 · 9.8 Critical EPSS 1.3% KEV · Not listed
Vendors
Sauter
Products
Ey-modulo 5 Devices Modulo 6 Devices
CVE-2025-41724

Sauter: Crash via Incomplete SOAP Request

An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests. The wscserver process will not be restarted by a watchdog and a device reboot is necessary to make it work again.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Sauter
Products
Ey-modulo 5 Devices Modulo 6 Devices Wscserver