SAUTER EY-modulo CVE-2025-41723

Exploitation requires network reachability to the affected product's SOAP interface and the ability to invoke the importFile method; the attacker supplies a path containing directory-traversal sequences to escape the restricted upload directory. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication and no user interaction are required against the exposed service, so there are no credential or configuration prerequisites named in the description. The primary limiting factor is exposure: the SOAP endpoint must be reachable by the attacker (e.g. not segmented behind a management-only network/firewall), which for building-automation devices is often an internal/OT network rather than the open Internet - materially reducing realistic attacker population despite the critical base score. Impact beyond file write (e.g. code execution) depends on where a writable location (web root, autostart, config path) exists on the target device.

Multiple signals point in the same direction for severity but diverge on real-world exploitation. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a textbook critical flaw: network-reachable, low-complexity, unauthenticated, no user interaction - consistent with the description of an unauthenticated remote directory-traversal file upload via the importFile SOAP method. CWE-35 (relative path traversal) and arbitrary file write to attacker-chosen locations typically escalate to full compromise, supporting the C:H/I:H/A:H impact. Against this, the exploitation-likelihood signals are modest: EPSS is 1.35% (71st percentile), there is NO CISA KEV listing, and NO public exploit was identified in the provided data - so this is 'no public exploit identified at time of analysis.' The gap between a 9.8 base score and a ~1% EPSS is best explained by the product's niche footprint (a Sauter building-automation component, inferred from the CERT@VDE/Sauter CSAF reference) rather than any weakness in the vulnerability itself - low attacker interest / small Internet-exposed population, not low technical severity. Net: a genuinely dangerous, trivially exploitable bug on affected devices, but one whose aggregate exploitation probability is held down by limited deployment. Treat as high priority for any organization actually running the affected Sauter product, especially if its SOAP interface is network-reachable, while recognizing it is unlikely to see opportunistic mass exploitation. Data gap: the specific product name and fixed version are not in the provided fields (only the CSAF advisory URL vde-2025-060), so affected-version scoping should be verified against that Sauter/CERT@VDE advisory.

An attacker who can reach the device's SOAP service sends a crafted importFile request containing a traversal sequence (e.g. ../../) in the target path, escaping the intended upload directory and writing an attacker-controlled file to an arbitrary location such as a web root or startup/config path. Because the vector is AV:N/AC:L/PR:N/UI:N, no credentials or user interaction are needed, and the planted file can be leveraged for code execution or configuration tampering. No public exploit was identified in the provided data, so this scenario is inferred from the description and CWE-35.