CVE-2025-41724
An unauthenticated remote attacker can crash the wscserver by sending incomplete SOAP requests. The wscserver process will not be restarted by a watchdog and a device reboot is necessary to make it work again.
- Score
- CVSS 3.1 7.5 High
- Status
- Deferred - info@cert.vde.com
- Published
- 2025-10-22
- Last modified
- 2026-10-18
- Weaknesses
- CWE-239
Affected products
- Ey-modulo 5 Ecos 5 Ecos504505 (Sauter)
- Ey-modulo 5 Modu 5 Modu524 (Sauter)
- Ey-modulo 5 Modu 5 Modu525 (Sauter)
- Modulo 6 Devices Modu612-lc (Sauter)
- Modulo 6 Devices Modu660-as (Sauter)
- Modulo 6 Devices Modu680-as (Sauter)
References
- https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-060.json
