Sauter Device CVE-2025-41720

Requires a valid low-privileged authenticated account on the affected Sauter device's webserver API (PR:L), reachable over the network (AV:N); the attacker uploads a file whose name ends in .png while the body contains arbitrary data, exploiting the fact that the upload handler verifies only the file extension and not the actual content/magic bytes. Limiting factors: exploitation is gated by prior authentication (not usable by fully unauthenticated attackers), impact is confined to low integrity (arbitrary data stored, no confidentiality or availability loss per the vector), and realistic consequences depend on how the device later consumes or serves the stored 'png' file.

This is a low-priority, limited-impact vulnerability rather than an urgent threat. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable but authenticated (PR:L) flaw with only low integrity impact and no confidentiality or availability impact. The EPSS score of 0.18% (7th percentile) indicates a very low probability of exploitation in the next 30 days, and there is no CISA KEV listing and no public exploit code, so all exploitation signals point the same direction - low real-world urgency. The signals are internally consistent (low CVSS + low EPSS + no KEV/POC), so there is no high-CVSS-but-hidden-risk tension here; if anything it is a low-CVSS, low-risk issue. One conflict to flag: the input Tag 'Information Disclosure' contradicts the CVSS vector, which sets C:N (no confidentiality impact) and I:L (low integrity impact) - this is an integrity/file-integrity weakness (CWE-646, reliance on file extension), not a confidentiality/disclosure issue; verify the classification with the Sauter/CERT@VDE advisory. No SSVC data was supplied.

An attacker who already holds a low-privilege account on a Sauter device's web interface crafts a file containing arbitrary (non-image) data, names it with a .png extension, and uploads it through the webserver API; because only the extension is checked, the malformed content is accepted and stored on the device. No public exploit code or active exploitation has been identified at time of analysis, and the attack requires valid low-privileged credentials, limiting it to insiders or attackers who have already obtained access.