CVE Alert: CVE-2025-41722 – Sauter – modulo 6 devices modu680-AS

Risk verdict

High risk: unauthenticated remote extraction of private keys enables device impersonation and compromise of SOAP communications; warrants urgent attention.

Why this matters

Hard-coded credentials create a durable vulnerability that can be exploited without user interaction, risking disclosure of cryptographic material and impersonation of affected devices. In practice, attackers could access central management traffic, tamper with commands, or exfiltrate sensitive data across building automation deployments.

Most likely attack path

The CVSS indicates network-based, unauthenticated access with no privileges required and no user interaction. An attacker could reach the WSC service, extract private keys, and use them to sign or validate SOAP messages, effectively impersonating legitimate devices. If network segmentation is weak, there is potential for limited lateral movement within trusted management domains.

Who is most exposed

Common in building automation and energy-management installations where modulo devices run on local networks or bridged management systems; exposure increases when these endpoints are reachable from less-trusted networks or the internet.

Detection ideas

• Unusual or unauthorized SOAP endpoint activity from unknown sources
• Access to key/certificate stores or private-key exfiltration indicators
• SOAP signature verification failures or unexpected certificates in use
• Device identity mismatches or impersonation events
• Elevated or anomalous access to WSC/admin APIs

Mitigation and prioritisation

• Apply vendor firmware updates to remediate hard-coded credential weaknesses; implement strict patch/change-management processes.
• Remove or rotate hard-coded credentials; deploy dynamic certificate handling and proper key management.
• Enforce network controls: restrict WSC access, implement segmentation, and apply least-privilege for management traffic.
• Increase logging/monitoring around key material access and SOAP/X509 validation events; set alerting for impersonation indicators.
• If KEV is true or EPSS ≥ 0.5, treat as priority 1. Validate via vendor guidance and plan a staged remediation.