CVE-2025-41742

The vulnerability stems from the presence of factory-set cryptographic keys in the device software (CWE-1394 — use of hardcoded cryptographic keys). An attacker with knowledge of these keys can establish a remote communication session with the device without needing to provide credentials. This mechanism allows for reading, modifying, and writing projects and data, as well as accessing any device through remote maintenance.

An attacker can gain full, unauthorized access to the device — read, modify, and write projects and configuration data, as well as take control of devices within remote service maintenance, which in an industrial environment (OT/ICS) can lead to disruption or sabotage of automation processes.

Patches available from the manufacturer should be applied according to the references (https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511042_de.pdf). Until the fix is deployed, it is recommended to isolate the network in which the devices operate, restrict access to management and remote maintenance ports exclusively to authorized hosts, and disable remote service maintenance functionality if it is not essential.

Sprecher Automation SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 (firmware versions indicated in the manufacturer's references)