Home

Description

The wsc server uses a hard-coded certificate to check the authenticity of SOAP messages. An unauthenticated remote attacker can extract private keys from the Software of the affected devices.

PUBLISHED Reserved 2025-04-16 | Published 2025-10-22 | Updated 2025-10-22 | Assigner CERTVDE




HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

CWE-798 Use of Hard-coded Credentials

Product status

Default status
unaffected

0.0.0 (semver) before Firmware v3.2.0
affected

Default status
unaffected

0.0.0 (semver) before Firmware v3.2.0
affected

Default status
unaffected

0.0.0 (semver) before Firmware v3.2.0
affected

Default status
unaffected

0.0 (semver) before Firmware v6.0
affected

Default status
unaffected

0.0 (semver) before Firmware v6.0
affected

Default status
unaffected

0.0 (semver) before Firmware v6.0
affected

Credits

Damian Pfammatter, Daniel Hulliger from Cyber-Defence Campus armasuisse S+T finder

References

sauter.csaf-tp.certvde.com/...f/white/2025/vde-2025-060.json

cve.org (CVE-2025-41722)

nvd.nist.gov (CVE-2025-41722)

Download JSON