SAUTER Web Interface CVE-2025-41719

Requires a valid LOW-PRIVILEGED authenticated account on the device's web interface (PR:L); with such access the attacker sets a sequence of unsupported characters in a user-configuration field to corrupt the user storage. No user interaction and no special non-default configuration are indicated - the device's default web user management is the attack surface. The only meaningful limiting factor is the need for pre-existing low-privilege credentials; there is no requirement for administrative rights, physical access, or a particular optional feature to be enabled.

This is a genuine high-priority issue for affected deployments, though the signals are mixed. The CVSS 3.1 base score of 8.8 is driven by a network-reachable (AV:N), low-complexity (AC:L) attack that needs only a single low-privileged account (PR:L) and no user interaction (UI:N), with high impact across confidentiality, integrity and availability. The real danger is the outcome described: corrupting the webserver user storage deletes ALL configured accounts and recreates a default Administrator with a KNOWN default password - effectively an unauthenticated-after-the-fact full takeover plus denial of service against legitimate operators. Countervailing signals temper urgency: EPSS is only 0.55% (45th percentile), there is no CISA KEV listing and no public POC identified, so there is no evidence of active or widespread exploitation. The SSVC framework is not supplied in the input, so exploitation/automatable/technical-impact decision values cannot be stated. Net: the technical impact is severe and the precondition (any low-privileged account) is modest, but the product is a niche building-automation device, so this is a serious-but-targeted risk rather than a mass-exploitation threat. Note also the input 'Information Disclosure' tag conflicts with the actual integrity/availability/privilege-escalation nature of the flaw.

An attacker who already holds any low-privileged account on a Sauter device's web interface submits a crafted sequence of unsupported characters into a user-management field. This corrupts the user storage, wiping every configured account and recreating a default Administrator whose password is publicly known, after which the attacker simply logs in with full administrative control. No public exploit code has been identified, but the attack is low-complexity and requires no user interaction.