Sauter wsc server CVE-2025-41722

No special conditions - remote unauthenticated exploitation against affected Sauter devices running the wsc server component, which uses a hard-coded certificate to validate SOAP message authenticity; network reachability of the wsc service is the only prerequisite (AV:N/AC:L/PR:N/UI:N). Limiting factors: the product is niche building-automation/OT equipment typically on segmented networks rather than the open internet, and the direct impact is confidentiality only (private-key disclosure) - leveraging the key for impersonation or MITM is a secondary step. The key being hard-coded means it is likely identical across units, so one successful extraction scales to the whole fleet.

Multiple signals point to a genuine but non-urgent issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, unauthenticated, low-complexity flaw, and the CWE-798 (hard-coded credentials) classification with a C:H/I:N/A:N impact is internally consistent: the vulnerability leaks a secret (private keys / hard-coded certificate) rather than directly altering or disabling the system. However, the exploitation-likelihood signals pull sharply the other way - EPSS is only 0.27% (18th percentile), the CVE is NOT on CISA KEV, and no public POC was supplied. This is therefore a high-CVSS but currently low-observed-risk issue typical of niche OT/building-automation gear. One important nuance the base score understates: because the certificate/key is hard-coded (and therefore almost certainly shared across the device fleet), a single extraction can compromise the trust model of every deployed unit, and the stolen key can be used to forge or authenticate SOAP messages downstream - so the real-world I-impact is higher than the I:N in the vector suggests. Patch/affected-version data and any KEV/POC status are absent from the input, so prioritization should be driven by whether these Sauter devices are internet-exposed, not by an active-exploitation signal.

An unauthenticated attacker with network access to a device's wsc server extracts the hard-coded private key / certificate material from the software. Having obtained the key, the attacker can forge or authenticate SOAP messages as a trusted party and, because the key is shared across devices, replay the same attack against the entire fleet. No public exploit code was identified in the provided data.