CVE-2025-41722: WSC Server Information Disclosure Flaw

CVE-2025-41722 Overview

CVE-2025-41722 affects the wsc server, which uses a hard-coded certificate to verify the authenticity of Simple Object Access Protocol (SOAP) messages. An unauthenticated remote attacker can extract the private key material from the device software. Because the certificate is embedded in every deployment, the same key protects every device running the affected firmware. The flaw is tracked under CWE-798: Use of Hard-coded Credentials.

Critical Impact
An unauthenticated network attacker can recover the private key embedded in the wsc server software and use it to forge or decrypt SOAP traffic across all affected devices.

Affected Products

Sauter wsc server software (per the CERT-VDE advisory)
Devices distributing the hard-coded SOAP authentication certificate
See the CERT-VDE Security Advisory for the authoritative product and version list

Discovery Timeline

2025-10-22 - CVE-2025-41722 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-41722

Vulnerability Analysis

The wsc server validates the authenticity of inbound SOAP messages using an X.509 certificate that ships embedded in the software image. Because the certificate and its corresponding private key are static and identical across deployments, the cryptographic trust boundary collapses to a single shared secret.

An unauthenticated remote attacker who obtains a firmware image or extracts data from a single device can recover the private key. With that key, the attacker can sign arbitrary SOAP requests that the wsc server will accept as authentic. The same key can also be used to impersonate the server to clients or to decrypt captured SOAP traffic protected by the certificate.

This class of weakness is catalogued as CWE-798: Use of Hard-coded Credentials. The Exploit Prediction Scoring System (EPSS) value for this CVE is 0.033%.

Root Cause

The authentication design relies on a certificate and private key that are distributed inside the shipped software rather than provisioned per device. Any party with read access to the binary can recover the key. Once recovered, the key cannot be rotated without a coordinated firmware update across every deployment.

Attack Vector

Exploitation occurs over the network and requires no authentication or user interaction. An attacker extracts the private key from the wsc software, then constructs SOAP messages signed with that key. The wsc server validates the signature against the embedded certificate and treats the forged request as legitimate.

No verified proof-of-concept code is publicly available. Refer to the CERT-VDE Security Advisory for further technical detail.

Detection Methods for CVE-2025-41722

Indicators of Compromise

SOAP requests to the wsc server originating from unexpected source IP ranges or external networks
Anomalous SOAP message volumes or timing patterns inconsistent with normal operator activity
Configuration changes on managed devices that do not correlate with authorized administrative sessions

Detection Strategies

Inspect SOAP traffic at the network perimeter and log signing certificate fingerprints used by clients
Alert on SOAP sessions to wsc endpoints from any host outside the documented management network
Correlate device configuration changes with authenticated operator sessions to flag out-of-band modifications

Monitoring Recommendations

Capture full packet data for wsc traffic to allow retroactive analysis once indicators are published
Forward device and management server logs to a centralized data lake for long-term retention and correlation
Monitor outbound connections from wsc hosts to detect post-exploitation lateral movement

How to Mitigate CVE-2025-41722

Immediate Actions Required

Restrict network access to the wsc server to a dedicated management VLAN or jump host
Block inbound SOAP traffic to affected devices from untrusted networks at the firewall
Inventory all devices running the affected wsc software using the CERT-VDE advisory as a reference
Review recent SOAP traffic and device configuration history for signs of unauthorized changes

Patch Information

Consult the CERT-VDE Security Advisory for vendor-supplied fixed versions and remediation guidance. A complete fix requires the vendor to replace the hard-coded certificate with per-device key provisioning. Apply firmware updates as soon as they are made available by the vendor.

Workarounds

Place affected devices behind a network segment that terminates and re-authenticates SOAP traffic
Require Internet Protocol Security (IPsec) or virtual private network (VPN) tunnels for all management traffic to the wsc server
Disable the wsc service on devices where SOAP-based management is not required

bash

# Example: restrict wsc SOAP access to a management subnet using iptables
# Replace 10.10.50.0/24 with your authorized management network and <WSC_PORT> with the service port
iptables -A INPUT -p tcp --dport <WSC_PORT> -s 10.10.50.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport <WSC_PORT> -j DROP