CVE-2025-41742CWE-1394

CVE-2025-41742

Critical · published December 2, 2025

CVSS v3.1
9.8
EPSS
0%
Percentile
39.1
In the wild
Unconfirmed
What it is

🚨 Default cryptographic keys are still in play, and that’s a recipe for disaster! An unauthorized attacker can waltz right in and access projects and devices without breaking a sweat. 🔥 Think of these default keys as an unguarded VIP entrance at a concert, letting anyone slip in without checks or questions. Just like a rogue fan could access exclusive backstage areas, an attacker can manipulate and control your data with ease. This vulnerability allows an attacker to read, modify, and write any project or data remotely, potentially leading to disastrous outcomes such as unauthorized changes or data theft. Imagine an intruder not only accessing sensitive information but also making changes that could disrupt operations entirely. This is absolutely devastating!

Put simply

Think of these default keys as an unguarded VIP entrance at a concert, letting anyone slip in without checks or questions. Just like a rogue fan could access exclusive backstage areas, an attacker can manipulate and control your data with ease. The flaw in Sprecher Automations SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 devices arises from the use of insecure default cryptographic keys. These keys lack proper protection, enabling unauthorized remote access and control over devices and data.

What to do

This vulnerability allows an attacker to read, modify, and write any project or data remotely, potentially leading to disastrous outcomes such as unauthorized changes or data theft. Imagine an intruder not only accessing sensitive information but also making changes that could disrupt operations entirely. This is absolutely devastating! Act now! Change the default cryptographic keys on all affected devices to strong, unique keys that only authorized users can access. Regularly audit your systems for any unauthorized access and ensure remote maintenance tools are secured. Don’t wait for an exploit to occur! You've got this! Follow these steps, and you'll fortify your defenses in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00462 · 39.1th percentile
Weakness
CWE-1394 · Use of Default Cryptographic Key
Published
2025-12-02T16:15Z
Affected products (3)
ProductVersionsFixed in
sprecher-automation/sprecon-e-c_firmwareall versions—
sprecher-automation/sprecon-e-p_firmwareall versions—
sprecher-automation/sprecon-e-t3_firmwareall versions—
References (1)
EPSS history
Timeline
  • 02 DEC 10:39Z
    Sprecher Automation: SPRECON-E series has a critical vulnerability due to the use of static cryptographic keys in system components
    cvelistv5