« Volver al listado

CVE-2025-41720

Estado: AplazadaMedia (4.3)—

A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-41720",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-41720",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-10-22T15:47:55.751768Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "Sauter",
          "product": "modulo 6 devices modu680-AS",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "Firmware v3.2.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sauter",
          "product": "modulo 6 devices modu660-AS",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "Firmware v3.2.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sauter",
          "product": "modulo 6 devices modu612-LC",
          "versions": [
            {
              "status": "affected",
              "version": "0.0.0",
              "lessThan": "Firmware v3.2.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sauter",
          "product": "EY-modulo 5 modu 5 modu524",
          "versions": [
            {
              "status": "affected",
              "version": "0.0",
              "lessThan": "Firmware v6.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sauter",
          "product": "EY-modulo 5 modu 5 modu525",
          "versions": [
            {
              "status": "affected",
              "version": "0.0",
              "lessThan": "Firmware v6.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sauter",
          "product": "EY-modulo 5 ecos 5 ecos504/505",
          "versions": [
            {
              "status": "affected",
              "version": "0.0",
              "lessThan": "Firmware v6.0",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-10-22T07:15:33.317",
  "references": [
    {
      "url": "https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-060.json",
      "source": "info@cert.vde.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-646"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified."
    }
  ],
  "lastModified": "2026-06-17T09:23:02.127",
  "sourceIdentifier": "info@cert.vde.com"
}