SAUTER wscserver CVE-2025-41724

Requires that the device's wscserver SOAP/web-services interface be reachable over the network from the attacker; no authentication, user interaction, or special configuration is indicated (PR:N/UI:N/AC:L). The limiting factors are network exposure of the wscserver endpoint and the fact that impact is confined to availability - the crash yields no code execution or data access. The outage is aggravated because no watchdog restarts the process, so recovery requires a manual device reboot rather than self-healing; deployments that segment or firewall the management/web-services port of these controllers substantially reduce exposure.

All signals point to a genuine but availability-only risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) describes remote, low-complexity, unauthenticated exploitation with no confidentiality or integrity impact - purely a denial of service, consistent with the CWE-239 (incomplete-element handling) classification and the 'Denial Of Service' tag. EPSS is low at 0.47% (40th percentile), indicating no statistical signal of mass exploitation, and there is no CISA KEV listing and no public proof-of-concept referenced, so this is not confirmed as actively exploited. No SSVC decision data was provided in the input. The signals are internally consistent rather than conflicting: a network-reachable DoS that is trivially triggered but yields no code execution or data exposure. The practical severity is amplified beyond a transient crash because the description states the wscserver process is not restarted by a watchdog and a full device reboot is required for recovery - meaning a single crafted request causes a persistent outage until manual intervention. Net assessment: a real priority for operational-availability-sensitive deployments (building automation / OT), but not a widespread-exploitation emergency given low EPSS, no KEV, and no known POC.

An attacker with network access to an affected device sends a malformed or truncated SOAP request to the wscserver web services endpoint. Because the request parser mishandles the incomplete element, the wscserver process crashes and is not restarted by any watchdog, leaving the service - and potentially device management - unavailable until an operator manually reboots the device. No public exploit code has been identified at time of analysis, though the low attack complexity makes the condition straightforward to reproduce.