CVE-2025-41742
Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.8
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.46%
- CWE
- CWE-1394
- Published
- 2025-12-02
- Last modified
- 2026-03-12
Affected products
- Sprecher Automation SPRECON-E-C
- Sprecher Automation SPRECON-E-P
- Sprecher Automation SPRECON-E-T3
Weakness type
Related vulnerabilities
- CVE-2026-75870 — Punk versions before 0.18 for Perl allow session cookie forgery via an empty default HMAC key when a session is declared without a secret
- CVE-2026-54887 — DTLS server cookie bypass during startup window due to empty initial cookie secret
- CVE-2026-5039 — Predictable Default Cryptographic Key Used for DES Encryption in TP-Link TL-WL841N
- CVE-2026-20709 — Use of Default Cryptographic Key in the hardware for some Intel(R) Pentium(R) Processor Silver...
- CVE-2026-2215 — rachelos WeRSS we-mp-rss JWT auth.py default key
- CVE-2026-25815 — Fortinet FortiOS through 7.6.6 allows attackers to decrypt LDAP credentials stored in device...
- CVE-2025-41744 — Sprecher Automation: SPRECON-E series has static default key material for TLS connections
- CVE-2025-55049 — Use of Default Cryptographic Key (CWE-1394)