Sauter
Monthly
Unauthorized code execution in Sauter EY-modulo building-automation controllers (modu680-AS, modu660-AS, modu612-LC) and ecoS ecos504/ecos505 field controllers stems from a Time-of-Check Time-of-Use race in a network-facing service, which an unauthenticated remote attacker can win to bypass intended security controls. CERT@VDE (advisory VDE-2026-093) coordinated disclosure and CVSS 4.0 rates it 9.3 (Critical) with full confidentiality, integrity and availability loss. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
Denial of service in SAUTER devices exposing the wscserver SOAP/web-services interface allows unauthenticated remote attackers to crash the server process by sending incomplete SOAP requests. Because no watchdog restarts wscserver, recovery requires a manual device reboot, making the availability impact lasting despite the high-only CVSS vector. No public exploit was identified at time of analysis, and EPSS is low at 0.47% (40th percentile).
Unauthenticated file write through directory traversal in SAUTER's importFile SOAP method allows remote attackers to bypass upload path restrictions and place files in arbitrary locations on the target. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), meaning no credentials or user interaction are required against a reachable SOAP endpoint. No CISA KEV entry is present and there is no public exploit identified at time of analysis; EPSS is 1.35% (71st percentile), and real-world risk is mainly bounded by whether the SOAP interface is exposed beyond internal or OT networks.
Hard-coded certificate key material in the wsc server component on Sauter devices can be extracted by unauthenticated remote attackers, undermining the authenticity checks applied to SOAP messages. The assessed impact is confidentiality-only (C:H/I:N/A:N), and exploitation requires only network reachability to the wsc service. No public exploit identified at time of analysis, and EPSS is 0.27%; because the key is hard-coded, a single extraction may weaken trust assumptions across affected units.
Sauter device administrators can inject unintended arguments into the OpenSSL invocation used by the password-protected self-signed certificate workflow, allowing integrity-impacting manipulation of the generated certificate or command behavior. The issue is reachable only through the management interface by an already high-privileged authenticated user (CVSS 2.7, PR:H), and no public exploit code or CISA KEV entry was identified at time of analysis; EPSS is only 0.20% (9th percentile), consistent with a low-priority insider or post-compromise risk.
Low-privileged users on affected Sauter devices can upload arbitrary content through the webserver API by naming it with a .png extension, because the upload handler checks only the file extension and not the actual file content. The CVSS vector confirms this is network-reachable but requires a valid low-privileged account, with impact limited to low integrity and no confidentiality or availability loss. EPSS is 0.18% (7th percentile), and no public exploit was identified at time of analysis.
Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 sends cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote attackers to bypass authentication by leveraging knowledge of a password hash without knowledge of the associated password. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Unauthorized code execution in Sauter EY-modulo building-automation controllers (modu680-AS, modu660-AS, modu612-LC) and ecoS ecos504/ecos505 field controllers stems from a Time-of-Check Time-of-Use race in a network-facing service, which an unauthenticated remote attacker can win to bypass intended security controls. CERT@VDE (advisory VDE-2026-093) coordinated disclosure and CVSS 4.0 rates it 9.3 (Critical) with full confidentiality, integrity and availability loss. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
Denial of service in SAUTER devices exposing the wscserver SOAP/web-services interface allows unauthenticated remote attackers to crash the server process by sending incomplete SOAP requests. Because no watchdog restarts wscserver, recovery requires a manual device reboot, making the availability impact lasting despite the high-only CVSS vector. No public exploit was identified at time of analysis, and EPSS is low at 0.47% (40th percentile).
Unauthenticated file write through directory traversal in SAUTER's importFile SOAP method allows remote attackers to bypass upload path restrictions and place files in arbitrary locations on the target. The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8), meaning no credentials or user interaction are required against a reachable SOAP endpoint. No CISA KEV entry is present and there is no public exploit identified at time of analysis; EPSS is 1.35% (71st percentile), and real-world risk is mainly bounded by whether the SOAP interface is exposed beyond internal or OT networks.
Hard-coded certificate key material in the wsc server component on Sauter devices can be extracted by unauthenticated remote attackers, undermining the authenticity checks applied to SOAP messages. The assessed impact is confidentiality-only (C:H/I:N/A:N), and exploitation requires only network reachability to the wsc service. No public exploit identified at time of analysis, and EPSS is 0.27%; because the key is hard-coded, a single extraction may weaken trust assumptions across affected units.
Sauter device administrators can inject unintended arguments into the OpenSSL invocation used by the password-protected self-signed certificate workflow, allowing integrity-impacting manipulation of the generated certificate or command behavior. The issue is reachable only through the management interface by an already high-privileged authenticated user (CVSS 2.7, PR:H), and no public exploit code or CISA KEV entry was identified at time of analysis; EPSS is only 0.20% (9th percentile), consistent with a low-priority insider or post-compromise risk.
Low-privileged users on affected Sauter devices can upload arbitrary content through the webserver API by naming it with a .png extension, because the upload handler checks only the file extension and not the actual file content. The CVSS vector confirms this is network-reachable but requires a valid low-privileged account, with impact limited to low integrity and no confidentiality or availability loss. EPSS is 0.18% (7th percentile), and no public exploit was identified at time of analysis.
Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 sends cleartext credentials, which allows remote attackers to obtain sensitive information by sniffing the network. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Sauter EY-WS505F0x0 moduWeb Vision before 1.6.0 allows remote attackers to bypass authentication by leveraging knowledge of a password hash without knowledge of the associated password. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.