Arbitrary File Upload Vulnerability in Sauter Webserver API
CVE-2025-41720

4.3MEDIUM

Key Information:

Vendor

Sauter

Status
Modulo 6 Devices Modu680-as
Modulo 6 Devices Modu660-as
Modulo 6 Devices Modu612-lc
Ey-modulo 5 Modu 5 Modu524
Vendor
CVE Published:
22 October 2025

What is CVE-2025-41720?

The Sauter Webserver API contains a vulnerability that permits low-privileged remote attackers to upload arbitrary data, masquerading as a PNG file. This risk arises due to insufficient validation of file content, as only the file extension is checked. Attackers can exploit this flaw to potentially introduce malicious files into the system, leading to unforeseen consequences.

Affected Version(s)

EY-modulo 5 ecos 5 ecos504/505 0.0

EY-modulo 5 modu 5 modu524 0.0

EY-modulo 5 modu 5 modu525 0.0

References

https://sauter.csaf-tp.certvde.com/.well-known/csaf/white...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Damian Pfammatter, Daniel Hulliger from Cyber-Defence Campus armasuisse
.