Critical Sauter AG Flaw (CVE-2025-41723, CVSS 9.8) Allows Unauthenticated File Upload via SOAP Interface

Swiss building automation manufacturer Sauter AG disclosed six vulnerabilities in the embedded firmware of its modulo 6 devices, with CVE-2025-41723 (CVSS 9.8) described as critical and allowing unauthenticated file uploads via the importFile SOAP method.

The advisory states that the vulnerabilities affect both the embedded web server and the SOAP-based interface used by SAUTER CASE Suite tools, enabling privilege escalation, remote exploitation, and potential compromise of device integrity, availability and confidentiality.

According to Sauter AG: “An unauthenticated remote attacker can bypass the path restriction and upload files to arbitrary locations.” The article notes that a second high-severity flaw, CVE-2025-41719 (CVSS 8.8), could let a low-privileged remote attacker delete all previously configured users and create a default Administrator with a known password, risking full administrative control.

Sauter AG strongly advises updating to firmware version 3.2.0 or newer for affected devices, including modulo 5 ecos and modulo 6 devices, as listed in the advisory.