Loading story…
A critical security vulnerability, tracked as CVE-2025-41723, has been identified in the importFile SOAP method used by Sauter products. This flaw allows unauthenticated remote attackers to bypass path restrictions and upload files to arbitrary locations on affected systems. The vulnerability is rated with a CVSS score of 9.8, indicating its severe potential impact on system security. According to the official CVE advisory, the vulnerability is remotely exploitable and does not require authentication, making it particularly dangerous for internet-exposed systems. Security researchers have highlighted that the flaw resides specifically in the importFile SOAP interface, which fails to properly validate file paths during upload operations. This improper validation enables attackers to perform directory traversal attacks, potentially overwriting critical system files or planting malicious executables. The vulnerability could be leveraged to gain persistent access, escalate privileges, or facilitate further attacks within the compromised environment. Although the exact affected product versions have not been enumerated in the CVE advisory, the issue is confirmed to impact Sauter AG's automation solutions that expose the vulnerable SOAP method. Security advisories recommend immediate mitigation steps, including disabling the importFile SOAP method if not required, applying vendor patches as soon as they become available, and monitoring for suspicious file upload activity. The flaw's unauthenticated nature means that even perimeter defenses may not prevent exploitation if the vulnerable interface is accessible. Organizations using Sauter AG products are urged to conduct a thorough review of their deployments to identify potential exposure. The vulnerability's disclosure has prompted increased scrutiny of SOAP-based interfaces in industrial and building automation systems. Security experts warn that similar flaws may exist in other products with insufficient input validation on file upload functions. The incident underscores the importance of rigorous security testing for web service interfaces, especially those handling file operations. No reports of active exploitation have been confirmed at the time of disclosure, but the high severity rating suggests that threat actors may soon attempt to weaponize the vulnerability. Sauter AG and CERT authorities are expected to release further guidance and updates as more information becomes available. Organizations are advised to stay alert for new advisories and to prioritize remediation of this critical flaw to prevent potential compromise.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
A critical vulnerability, CVE-2025-41723, was publicly disclosed affecting Sauter AG systems. The flaw involves an unauthenticated file upload via the SOAP importFile interface and is described as a directory traversal issue with a CVSS score of 9.8.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical path traversal vulnerability (CVE-2024-48510) has been identified in Rockwell Automation's AADvance-Trusted SIS Workstation, specifically affecting versions 2.00.00 to 2.00.04. The flaw, rooted in the DotNetZip library (v1.16.0 and earlier), could allow a remote attacker to execute arbitrary code if a victim opens a malicious file, potentially compromising safety instrumented system (SIS) applications used in critical manufacturing sectors. The vulnerability is rated high severity, with a CVSS v4 score of 8.6, and exploitation requires user interaction but is considered low complexity and remotely exploitable. Rockwell Automation discovered the issue during internal testing and reported it to CISA, emphasizing their commitment to transparency and product security. The company has released a security advisory confirming the vulnerability, noting that it has been corrected and that no known exploitation has occurred in the wild. Organizations using affected SIS Workstation versions are urged to apply available mitigations to prevent potential remote code execution attacks targeting critical infrastructure environments worldwide.
Jun 29, 2026
A critical relative path traversal vulnerability, identified as CVE-2025-62498, was discovered in *AutomationDirect Productivity Suite* software, specifically affecting versions up to 4.4.1.19. This vulnerability, also known as ZipSlip, allows an attacker who can tamper with a productivity project file to execute arbitrary code on the machine where the project is opened. The flaw is remotely exploitable and has been assigned a CVSS v3.1 base score of 8.8 and a CVSS v4 score of 9.3, indicating high severity. The vulnerability impacts multiple *Productivity* PLC models, including Productivity 3000, 2000, and 1000 series CPUs running affected software versions. Successful exploitation could enable attackers to gain full control over the affected system, potentially leading to information disclosure, unauthorized file access, or further compromise of industrial control environments. The vulnerability was reported to ICS-CERT, and advisories have been published to inform users and administrators of the risk and to recommend mitigation steps. No affected product table was provided in the CVE feed, but CISA's advisory lists specific impacted models and software versions, emphasizing the need for immediate attention from organizations using these products in critical infrastructure environments.
Jul 12, 2026
Advantech WebAccess/SCADA has been found to contain several critical vulnerabilities, including an unrestricted file upload flaw (CVE-2025-14849) and a directory traversal vulnerability (CVE-2025-14850). The unrestricted file upload issue could allow a remote attacker to execute arbitrary code on affected systems, while the directory traversal flaw may enable attackers to delete arbitrary files. Both vulnerabilities are remotely exploitable and have been assigned high CVSS scores, indicating significant risk to organizations using this software in critical infrastructure sectors. CISA has issued an advisory confirming that these vulnerabilities affect Advantech WebAccess/SCADA version 9.2.1, and recommends updating to version 9.2.2 to mitigate the risks. The vulnerabilities impact organizations in sectors such as critical manufacturing, energy, and water and wastewater, with deployments worldwide. Exploitation of these flaws could allow authenticated attackers to read or modify remote databases, potentially leading to severe operational disruptions.
Jun 29, 2026