{"api_version":"1","generated_at":"2026-10-23T07:25:11+00:00","cve":"CVE-2025-41742","urls":{"html":"https://cve.report/CVE-2025-41742","api":"https://cve.report/api/cve/CVE-2025-41742.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-41742","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-41742"},"summary":{"title":"Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system components","description":"Sprecher Automations SPRECON-E-C,  SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance.","state":"PUBLISHED","assigner":"CERTVDE","published_at":"2025-12-02 11:15:51","updated_at":"2026-09-26 00:10:00"},"problem_types":["CWE-1394","CWE-1394 CWE-1394 Use of Default Cryptographic Key"],"metrics":[{"version":"3.1","source":"info@cert.vde.com","type":"Secondary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511042_de.pdf","name":"https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511042_de.pdf","refsource":"info@cert.vde.com","tags":["Vendor Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-41742","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-41742","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Sprecher Automation","product":"SPRECON-E-C","version":"affected *","platforms":[]},{"source":"CNA","vendor":"Sprecher Automation","product":"SPRECON-E-P","version":"affected *","platforms":[]},{"source":"CNA","vendor":"Sprecher Automation","product":"SPRECON-E-T3","version":"affected *","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"Sec-Consult Security Labs","lang":"en"}],"nvd_cpes":[{"cve_year":"2025","cve_id":"41742","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"sprecher-automation","cpe5":"sprecon-e-c","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"41742","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"sprecher-automation","cpe5":"sprecon-e-c_firmware","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"41742","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"sprecher-automation","cpe5":"sprecon-e-p","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"41742","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"sprecher-automation","cpe5":"sprecon-e-p_firmware","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"41742","vulnerable":"0","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"sprecher-automation","cpe5":"sprecon-e-t3","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2025","cve_id":"41742","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"sprecher-automation","cpe5":"sprecon-e-t3_firmware","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2025","cve_id":"41742","cve":"CVE-2025-41742","epss":"0.004620000","percentile":"0.375930000","score_date":"2026-09-27","updated_at":"2026-09-28 00:02:20"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2025-41742","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2025-12-02T16:53:16.856849Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2025-12-02T16:54:31.534Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"SPRECON-E-C","vendor":"Sprecher Automation","versions":[{"status":"affected","version":"*"}]},{"defaultStatus":"unaffected","product":"SPRECON-E-P","vendor":"Sprecher Automation","versions":[{"status":"affected","version":"*"}]},{"defaultStatus":"unaffected","product":"SPRECON-E-T3","vendor":"Sprecher Automation","versions":[{"status":"affected","version":"*"}]}],"credits":[{"lang":"en","type":"reporter","user":"00000000-0000-4000-9000-000000000000","value":"Sec-Consult Security Labs"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Sprecher Automations SPRECON-E-C,  SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance."}],"value":"Sprecher Automations SPRECON-E-C,  SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-1394","description":"CWE-1394 Use of Default Cryptographic Key","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2025-12-02T10:39:08.982Z","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","shortName":"CERTVDE"},"references":[{"tags":["vendor-advisory"],"url":"https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511042_de.pdf"}],"source":{"defect":["CERT@VDE#641892"],"discovery":"UNKNOWN"},"title":"Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system components","x_generator":{"engine":"Vulnogram 0.1.0-dev"}}},"cveMetadata":{"assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","assignerShortName":"CERTVDE","cveId":"CVE-2025-41742","datePublished":"2025-12-02T10:39:08.982Z","dateReserved":"2025-04-16T11:17:48.321Z","dateUpdated":"2025-12-02T16:54:31.534Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-12-02 11:15:51","lastModifiedDate":"2026-09-26 00:10:00","problem_types":["CWE-1394","CWE-1394 CWE-1394 Use of Default Cryptographic Key"],"metrics":{"cvssMetricV31":[{"source":"info@cert.vde.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-12-02T16:53:16.856849Z","id":"CVE-2025-41742","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:sprecher-automation:sprecon-e-c_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"9DF00EFE-05D9-48D1-9D32-B0E4E40D14F3"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:sprecher-automation:sprecon-e-c:*:*:*:*:*:*:*:*","matchCriteriaId":"17CF3E5A-AAD9-4B96-945D-501E461661CC"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:sprecher-automation:sprecon-e-p_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"F27A10F8-544C-4B48-9FB9-198D79CCB885"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:sprecher-automation:sprecon-e-p:*:*:*:*:*:*:*:*","matchCriteriaId":"E0CC75D6-DD26-42A0-83F4-69423D8F5284"}]}]},{"operator":"AND","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:sprecher-automation:sprecon-e-t3_firmware:-:*:*:*:*:*:*:*","matchCriteriaId":"B0BDEAF2-092F-413D-9D16-AAFA484D13AB"}]},{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":false,"criteria":"cpe:2.3:h:sprecher-automation:sprecon-e-t3:*:*:*:*:*:*:*:*","matchCriteriaId":"6384D2B2-DCDA-445B-8336-E4EF0E2B3267"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"41742","Ordinal":"1","Title":"Sprecher Automation: SPRECON-E series has a critical vulnerabili","CVE":"CVE-2025-41742","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"41742","Ordinal":"1","NoteData":"Sprecher Automations SPRECON-E-C,  SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use of these keys allows the attacker to read, modify, and write projects and data, or to access any device via remote maintenance.","Type":"Description","Title":"Sprecher Automation: SPRECON-E series has a critical vulnerabili"}]}}}