CVE-2025-41720

A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified.

CVSS v3 4.3 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-060.json

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Un atacante remoto con pocos privilegios puede cargar datos arbitrarios enmascarados como un archivo png al dispositivo afectado utilizando la API del servidor web porque solo se verifica la extensión del archivo.

Information

Published : 2025-10-22 07:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-41720

Mitre link : CVE-2025-41720

CVE.ORG link : CVE-2025-41720

JSON object : View

Products Affected

No product.

CWE

CWE-646

Reliance on File Name or Extension of Externally-Supplied File

{"id": "CVE-2025-41720", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-41720", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-22T15:47:55.751768Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "info@cert.vde.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}]}, "affected": [{"source": "info@cert.vde.com", "affectedData": [{"vendor": "Sauter", "product": "modulo 6 devices modu680-AS", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "Firmware v3.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Sauter", "product": "modulo 6 devices modu660-AS", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "Firmware v3.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Sauter", "product": "modulo 6 devices modu612-LC", "versions": [{"status": "affected", "version": "0.0.0", "lessThan": "Firmware v3.2.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Sauter", "product": "EY-modulo 5 modu 5 modu524", "versions": [{"status": "affected", "version": "0.0", "lessThan": "Firmware v6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Sauter", "product": "EY-modulo 5 modu 5 modu525", "versions": [{"status": "affected", "version": "0.0", "lessThan": "Firmware v6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Sauter", "product": "EY-modulo 5 ecos 5 ecos504/505", "versions": [{"status": "affected", "version": "0.0", "lessThan": "Firmware v6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2025-10-22T07:15:33.317", "references": [{"url": "https://sauter.csaf-tp.certvde.com/.well-known/csaf/white/2025/vde-2025-060.json", "source": "info@cert.vde.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "info@cert.vde.com", "description": [{"lang": "en", "value": "CWE-646"}]}], "descriptions": [{"lang": "en", "value": "A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified."}, {"lang": "es", "value": "Un atacante remoto con pocos privilegios puede cargar datos arbitrarios enmascarados como un archivo png al dispositivo afectado utilizando la API del servidor web porque solo se verifica la extensi\u00f3n del archivo."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "info@cert.vde.com"}