EUVD-2026-68988
GHSA-jc56-mhh5-666m
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable and unauthenticated (AV:N/PR:N/UI:N), but a TOCTOU race must be won so AC:H; bypass leads to code execution giving full C/I/A impact.
Primary rating from Vendor (CERTVDE).
CVSS VectorVendor: CERTVDE
Lifecycle Timeline
3DescriptionCVE.org
A service running on the affected products contains a potential Time-of-Check Time-of-Use (TOCTOU) race condition. An unauthenticated remote attacker could exploit this race condition to bypass intended security controls. This may result in the execution of unauthorized code.
AnalysisAI
Unauthorized code execution in Sauter EY-modulo building-automation controllers (modu680-AS, modu660-AS, modu612-LC) and ecoS ecos504/ecos505 field controllers stems from a Time-of-Check Time-of-Use race in a network-facing service, which an unauthenticated remote attacker can win to bypass intended security controls. CERT@VDE (advisory VDE-2026-093) coordinated disclosure and CVSS 4.0 rates it 9.3 (Critical) with full confidentiality, integrity and availability loss. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the vulnerable service running on a Sauter modu680-AS, modu660-AS, modu612-LC, ecos504 or ecos505 controller; no credentials and no user interaction are needed (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes an unauthenticated, network-reachable flaw with total system impact, which is why it scores 9.3. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the fixed firmware for each affected model as published in Sauter/CERT@VDE advisory VDE-2026-093 (https://www.certvde.com/en/advisories/VDE-2026-093/; CSAF: https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-093.json) - no exact fixed version was provided in this intelligence, so consult the advisory for the precise patched build per model (Patch available per vendor advisory). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Sauter EY-modulo (modu680-AS, modu660-AS, modu612-LC) and ecoS (ecos504, ecos505) controllers to identify which are internet-accessible or on shared networks; immediately isolate exposed systems from external access where operationally feasible and document any that must remain connected due to facility criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today