CVE-2025-41720
A low privileged remote attacker can upload arbitrary data masked as a png file to the affected device using the webserver API because only the file extension is verified.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 4.3
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- EPSS probability
- 0.17%
- CWE
- CWE-646
- Published
- 2025-10-22
- Last modified
- 2026-03-12
Affected products
- Sauter modulo 6 devices modu680-AS
- Sauter modulo 6 devices modu660-AS
- Sauter modulo 6 devices modu612-LC
- Sauter EY-modulo 5 modu 5 modu524
- Sauter EY-modulo 5 modu 5 modu525
- Sauter EY-modulo 5 ecos 5 ecos504/505
Weakness type
Related vulnerabilities
- CVE-2026-45315 — Open WebUI: Stored XSS via attacker-controlled file extension in /api/v1/audio/transcriptions
- CVE-2026-20172 — Cisco Enterprise Chat and Email Lite Agent File Upload Vulnerability
- CVE-2025-30662 — Zoom Workplace VDI Plugin macOS Universal Installer - Symlink Following
- CVE-2025-58449 — Maho Vulnerable to Authenticated Remote Code Execution via File Upload
- CVE-2025-1889 — picklescan - Security scanning bypass via non-standard file extensions
- CVE-2024-52052 — Stream Target Remote Code Execution in Wowza Streaming Engine
- CVE-2024-38432 — Matrix – Tafnit v8 CWE-646: Reliance on File Name or Extension of Externally-Supplied File
- CVE-2023-45599 — A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the...