{"id":"CVE-2025-41742","state":"PUBLISHED","title":"Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system components","description":"Sprecher Automations SPRECON-E-C,  SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance.","publishedAt":"2025-12-02T10:39:08.982Z","updatedAt":"2025-12-02T16:54:31.534Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CERTVDE"},"assigner":"CERTVDE","products":["Sprecher Automation SPRECON-E-C","Sprecher Automation SPRECON-E-P","Sprecher Automation SPRECON-E-T3"],"affected":[{"vendor":"Sprecher Automation","product":"SPRECON-E-C","defaultStatus":"unaffected","versions":[{"version":"*","status":"affected"}]},{"vendor":"Sprecher Automation","product":"SPRECON-E-P","defaultStatus":"unaffected","versions":[{"version":"*","status":"affected"}]},{"vendor":"Sprecher Automation","product":"SPRECON-E-T3","defaultStatus":"unaffected","versions":[{"version":"*","status":"affected"}]}],"references":["https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511042_de.pdf"],"weaknesses":["CWE-1394"],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/41xxx/CVE-2025-41742.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-41742","state":"PUBLISHED","datePublished":"2025-12-02T10:39:08.982Z","dateUpdated":"2025-12-02T16:54:31.534Z","assignerShortName":"CERTVDE","assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateReserved":"2025-04-16T11:17:48.321Z"},"containers":{"cna":{"title":"Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system components","descriptions":[{"lang":"en","value":"Sprecher Automations SPRECON-E-C,  SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance."}],"affected":[{"vendor":"Sprecher Automation","product":"SPRECON-E-C","defaultStatus":"unaffected","versions":[{"version":"*","status":"affected"}]},{"vendor":"Sprecher Automation","product":"SPRECON-E-P","defaultStatus":"unaffected","versions":[{"version":"*","status":"affected"}]},{"vendor":"Sprecher Automation","product":"SPRECON-E-T3","defaultStatus":"unaffected","versions":[{"version":"*","status":"affected"}]}],"references":[{"url":"https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511042_de.pdf","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1394","description":"CWE-1394 Use of Default Cryptographic Key","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERTVDE","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateUpdated":"2025-12-02T10:39:08.982Z"},"credits":[{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"Sec-Consult Security Labs"}],"source":{"defect":["CERT@VDE#641892"],"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2025-12-02T16:53:16.856849Z","id":"CVE-2025-41742","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2025-12-02T16:54:31.534Z"}}]}}}