CVE-2025-41720

Full vulnerability record from the local CVENow database.
Description

A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified.
Severity
MEDIUM
CVSS score
4.3 (v3.1)
Vulnerability status
Deferred
Source identifier
[email protected]
Published
2025-10-22 07:15:33.317000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
  "id": "CVE-2025-41720",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-22T07:15:33.317",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified."
    },
    {
      "lang": "es",
      "value": "Un atacante remoto con pocos privilegios puede cargar datos arbitrarios enmascarados como un archivo png al dispositivo afectado utilizando la API del servidor web porque solo se verifica la extensión del archivo."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Sauter",
          "product": "modulo 6 devices modu680-AS",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0.0.0",
              "lessThan": "Firmware v3.2.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Sauter",
          "product": "modulo 6 devices modu660-AS",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0.0.0",
              "lessThan": "Firmware v3.2.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Sauter",
          "product": "modulo 6 devices modu612-LC",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0.0.0",
              "lessThan": "Firmware v3.2.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Sauter",
          "product": "EY-modulo 5 modu 5 modu524",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0.0",
              "lessThan": "Firmware v6.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Sauter",
          "product": "EY-modulo 5 modu 5 modu525",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0.0",
              "lessThan": "Firmware v6.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Sauter",
          "product": "EY-modulo 5 ecos 5 ecos504/505",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0.0",
              "lessThan": "Firmware v6.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-22T15:47:55.751768Z",
          "id": "CVE-2025-41720",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-646"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-060.json",
      "source": "[email protected]"
    }
  ]
}