CVE-2025-41744

Sprecher Automation: SPRECON-E series has static default key material for TLS connections

Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereby compromising confidentiality and integrity.

Affected

Sprecher Automation · SPRECON-E-C · SPRECON-E-P · SPRECON-E-T3

CVSS v3.1 CERT

9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

0.41% chance of exploitation in the next 30 days, 34th percentile

Published

2025-12-02

Proof-of-concept exploits (1)

• gromila7813/CVE-2025-417440★ · 2025-12-03

Security advisories

• https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511043_de.pdf

References

• CVE Record
• NVD entry