« Volver al listado

CVE-2025-41743

Estado: AnalizadaMedia (4)—

Insufficient encryption strength in Sprecher Automation SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 allows a local unprivileged attacker to extract data from update images and thus obtain limited information about the architecture and internal processes.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Sprecher-automation — Sprecon-e-c FirmwareSprecher-automation — Sprecon-e-p FirmwareSprecher-automation — Sprecon-e-t3 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-41743",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-41743",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-02T16:50:29.885950Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "info@cert.vde.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.5
      }
    ]
  },
  "affected": [
    {
      "source": "info@cert.vde.com",
      "affectedData": [
        {
          "vendor": "Sprecher Automation",
          "product": "SPRECON-E-C",
          "versions": [
            {
              "status": "affected",
              "version": "1.0",
              "lessThan": "9.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sprecher Automation",
          "product": "SPRECON-E-P",
          "versions": [
            {
              "status": "affected",
              "version": "1.0",
              "lessThan": "9.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Sprecher Automation",
          "product": "SPRECON-E-T3",
          "versions": [
            {
              "status": "affected",
              "version": "1.0",
              "lessThan": "9.0",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-12-02T11:15:51.493",
  "references": [
    {
      "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511043_de.pdf",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "info@cert.vde.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "info@cert.vde.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-326"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient encryption strength in Sprecher Automation SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 allows a local unprivileged attacker to extract data from update images and thus obtain limited information about the architecture and internal processes."
    },
    {
      "lang": "es",
      "value": "Fuerza de cifrado insuficiente en Sprecher Automation SPRECON-E-C, SPRECON-E-P y SPRECON-E-T3 permite a un atacante local sin privilegios extraer datos de las imágenes de actualización y así obtener información limitada sobre la arquitectura y los procesos internos."
    }
  ],
  "lastModified": "2026-09-26T00:10:00.127",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sprecher-automation:sprecon-e-c_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3F16637E-B261-45EE-A044-0D023B1791B1",
              "versionEndExcluding": "9.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sprecher-automation:sprecon-e-c:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "17CF3E5A-AAD9-4B96-945D-501E461661CC"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sprecher-automation:sprecon-e-p_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1385AA3-CFBA-48E7-BDD0-9540A3F9BBD0",
              "versionEndExcluding": "9.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sprecher-automation:sprecon-e-p:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "E0CC75D6-DD26-42A0-83F4-69423D8F5284"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:sprecher-automation:sprecon-e-t3_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B3F44433-638E-4282-8488-602C38A2491B",
              "versionEndExcluding": "9.0"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:sprecher-automation:sprecon-e-t3:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "6384D2B2-DCDA-445B-8336-E4EF0E2B3267"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "info@cert.vde.com"
}