Sauter Devices CVE-2025-41721

Exploitation requires high-privileged authenticated access to the affected Sauter device's management interface (PR:H); it is not reachable by anonymous or low-privileged users. The specific trigger is the certificate-management workflow for adding a password-protected self-signed certificate, where special elements in the supplied parameters are not neutralized before being passed to the openssl command. Limiting factors: the attacker must already be an administrative/high-privilege operator (restricting realistic abuse to malicious insiders or post-compromise escalation), the action is confined to the certificate-add feature, and impact is integrity-only (C:N/A:N), so no data disclosure or denial of service results.

This is a genuinely LOW-priority issue, and the signals are consistent rather than conflicting. The CVSS 3.1 base score is 2.7 with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - network-reachable and low-complexity, but gated behind PR:H (high privileges), with only partial integrity impact and no confidentiality or availability impact. EPSS reinforces this: 0.20% probability at the 9th percentile indicates very low expected exploitation activity. There is no CISA KEV listing and no public exploit identified, so exploitation status is 'no public exploit identified at time of analysis.' Mapping to an SSVC-style frame: exploitation = none, automatable = no (an attacker must already be a privileged, authenticated operator and interact with a certificate-management workflow), and technical impact = partial (integrity-only, I:L). The one thing to note is the product scope: the 'OpenSSL' tag could be misread as the OpenSSL library itself, but the vendor reference (sauter.csaf-tp.certvde.com, CERT@VDE advisory VDE-2025-060) and the description make clear the flaw is command-argument injection into an invocation of the openssl CLI within a Sauter product - not a vulnerability in OpenSSL. Net: a high-CVSS illusion is not present here; this is a correctly-scored low-severity, privilege-gated issue best treated as hardening rather than an emergency.

An attacker who already holds high-privileged (administrative) authenticated access to the affected Sauter device's management interface adds a password-protected self-signed certificate, embedding special shell/command elements in the supplied parameters (e.g., the password or certificate fields). Because these elements are not neutralized before being passed to the openssl command, the injected input is interpreted by the command, yielding limited (integrity-only) command injection. No public proof-of-concept or exploit code has been identified at the time of analysis.