Find a vulnerability

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Sprecher Automation SPRECON-E-C/-E-P/-E-T3",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260617-0 \u003e\n=======================================================================\n              title: Multiple Critical Vulnerabilities\n            product: Sprecher Automation SPRECON-E-C/-E-P/-E-T3\n\u00a0vulnerable version: See vulnerable versions below\n      fixed version: See solution section below\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2022-4333, CVE-2022-4332, CVE-2025-41741,\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 CVE-2025-41742, CVE-2025-41743, CVE-2025-41744\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: critical\n           homepage:https://www.sprecher-automation.com/\n  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2022-08-26\n                 by: Steffen Robertz\n                     Christian Hager (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n=======================================================================\n\nVendor description:\n-------------------\n\"Sprecher Automation provides products and solutions for power supply\nand process automation. We secure critical infrastructures and optimise\ncomplex energy and industry processes. [...]\nQuality, availability and security \u2013 those are not only our customers\u0027s\nrequirements, but also goals we are striving for. Due to that, for example,\nthe hard- and software development are located in Austria and Germany.\nWe produce exclusively in Austria \u2013 starting with the production of\nsingle elements, to system checks and practical inhouse testing.\"\n\nSource:https://www.sprecher-automation.com/en/company\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides updated versions as well as workaround information in\ntheir security advisories. Users should verify whether the patches are\ninstalled already, otherwise patch immediately.\n\nSEC Consult highly recommends to perform a thorough security review of\nthe product conducted by security professionals to identify and resolve\npotential further security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Leak of Firmware Signing Private Key (CVE-2025-41741)\nSprecher signs its firmware update files to prevent an attacker from\nloading manipulated update files. However, each PLC contains the\nglobally valid private signing key, as it is also used to sign backups.\nAn attacker, who obtains the key is able to ship validly signed,\nmodified firmware updates.\n\nThe security vulnerability has been resolved in firmware version 9 and\nabove. Further details can be found in the advisory of the vendor. In\nprevious versions the affected feature can be deactivated by the customer.\nThe stated key can only be used in conjunction with the backup feature.\nAffected products: SPRECON-E-C/-E-P/-E CPU Modul\n\n2) Missing Secure-Boot Mechanism (CVE-2022-4332)\nThe PLC is able to detect secure boot violations correctly. However,\nthe events are not handled properly. They only output a warning to the\nboot log, but do not prevent the device\u0027s operation. Thus, anybody with\nphysical access to the device can modify the firmware and potentially\ninclude backdoors.\n\nThe security vulnerability has been resolved in firmware version 8.71a and\nabove, as well as 8.64m. Further details can be found in the advisory\nof the vendor. In current and previous versions the affected feature can be\ndeactivated by the customer.\nAffected products: SPRECON-E-C/-E-P/-E\n\n3) Unencrypted External Flash Memory (CVE-2022-4332)\nThe external flash memory can be dumped using tools such as the Xgecu\nT56. This allows an attacker with physical access to read all files and\nthus gain knowledge about sensitive files such as passwords and private\nkeys.\n\nThe security vulnerability has been resolved in firmware version 9 and above.\nFurther details can be found in the advisory of the vendor. In current and\nprevious versions the affected feature can be deactivated by the customer.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n4) Usage of static passwords (CVE-2025-41742)\nVarious static passwords / key material can be discovered in the firmware.\nThey serve  different use cases, such as hard-coded user accounts, as well as\nencryption for settings and configuration files. This allows an attacker\nto decrypt configuration files, modify them and properly encrypt them\nagain.\n\nAccording to the vendor, the documented static identity string does not serve\na security purpose in the system and is used as an identifier for maintenance.\nUsing the default identifier can lead to the targeted system being misidentified\nduring maintenance.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n5) Hard-coded Vendor Accounts (CVE-2022-4333)\nTwo hard-coded vendor accounts were revealed in the devices. These\naccounts are shipped with every update file and can be used by the\nvendor e.g. for support access.\n\nThese documented accounts can be activated or deactivated in the configuration.\nThese accounts are additionally secured with 2FA in firmware version 8.71g.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n6) Decrypt Firmware Update Files (CVE-2025-41743)\nFirmware update files include hard-coded accounts from vulnerability 5 and\ncan be decrypted using an XOR algorithm and a static password. This\nallows an attacker to further analyze PLC components as well as gaining\nknowledge of private keys and hard-coded accounts without requiring\nphysical access to any device.\n\nThe signature and encryption mechanism have been modified and the security\nvulnerability has been resolved in version 8.71 and above. Further details\ncan be found in the advisory of the vendor.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n7) Insecure Transport Encryption (CVE-2025-41744)\nThe PLC\u0027s webserver and the connection to the Sprecher Engineering Center\nsoftware use the same static default key on all devices. An attacker who gains\naccess to the private key via vulnerability 3 or 6 can thus decrypt all\ntraffic in a man-in-the-middle position. Thus, an attacker would be\nable to change configurations and read connection passwords.\n\nAccording to the vendor, those certificates are only used during initial\ncommissioning and users can find further information to change the certificates\nin the documentation/guideline \"SPRECON Grundh\u00e4rtung\" (basic hardening).\nThe vendor\u0027s hardening guide makes it clear that it is both possible and\nrecommended to change the default certificate.\nDocumentation: 94.2.913.50en SPRECON Basic Hardening\n\n\nProof of concept:\n-----------------\n1) Leak of Firmware Signing Private Key (CVE-2025-41741)\nBackups are restored by the same command flow as regular update files.\nThus, backups need to be validly signed as well. For this, Sprecher\u0027s\nprivate key is required. The following openssl command signs the\ncreated backup:\n\n```\nopenssl dgst -sha256 -sign ${SSM_CERT}/.backup.key -passinfile:${SSM_CERT}/.pass -out\n${SSM_SECURE_DIR}/image.sha256 ${SSM_SECURE_DIR}/image.zip 2\u003e/dev/null\n```\n\nThe private key and password are both stored in the same filesystem and\ncan be obtained via the decrypted firmware update file (vulnerability 6)\nor the unencrypted flash memory (vulnerability 3).\n\n\n2) Missing Secure-Boot Mechanism (CVE-2022-4332)\nThe main SoC of the SPRECON E-C-94 is an i.MX6. The board does not fully\nenable High-Assurance Boot (HAB). Thus, the firmware and bootloader can\nbe modified. The modification is detected, however, since secure boot is\nnot fully enabled, the violation will not be handled. The following boot\nlog  can be seen on the device\u0027s service connector (X6). The first\nbootline was manipulated to include the string \"SECTEST\".\n\n```\nREL_UBOOT_SECTEST_2015_07_RC7 SPL (Mar 11 2022 - 10:55:26)\nBooting from SPI\nImage Entry Point: 0x17800000\nImage Load Address: 0x177FFFC0\nImage Size: 0x48000\nAuthenticate image from DDR location 0x177fffc0...\nAuthenticated Image Size = 0x46000\nLoad Addr = 0x17800000\nHAB not enabled\nU-Boot Authentication Successful\n[...]\nAuthenticate image from DDR location 0x12000000...\nAuthenticated Image Size = 0x7bc000\nHAB not enabled\nHAB Configuration: 0xf0, HAB State: 0x66\n--------- HAB Event 1 -----------------\n[...]\nzImage Authentication Successful\n```\n\n3) Unencrypted External Flash Memory (CVE-2022-4332)\nThe main memory is a BGA153 eMMC flash memory. Thus, it can be read by\nmultiple tools such as the Xgecu T56. By dumping its contents, an\nattacker can extract password hashes from the `/etc/passwd` or\n`/etc/shadow` file and gain access to the private key from\nvulnerability 1.\n\n\n4) Usage of static passwords (CVE-2025-41742)\n\u00a0 \u00a0 4.1) Static Passwords in Sprecher Engineering Studio\n                 Two different passwords can be used to call an internal function.\n         This can be seen in following code snippet:\n                \n                 ```\n                 iVar3 = _strcmp(local_28,\"**redacted**\");\n                 if (((iVar3 == 0) || (iVar3 = _strcmp(local_28,\"**redacted**\"), iVar3 == 0)) ||(iVar3 = \n_strcmp(local_28,\"**redacted**\"), iVar3 == 0)) {\n                        FUN_10001780(local_28,0x20,\"XXX\");\n                 }\n                 ```\n                \n                 Unfortunately, we were not able to fully determine the use case of\n         these credentials.\n        \n        4.2) Static Passwords in Sprecher Engineering Studio Configuration files\n                 When exporting configurations from the Engineering Studio, a .sprXecz\n                 file will be created. It is encrypted using a static password.\n\n        4.3) Webserver Settings Export\n                 The webserver exports its settings as .jzp file. However, this\n                 is just a renamed .zip file which uses a static password.\n\n        4.4) OpenVPN and IPSEC Settings Export/Import\n                 OpenVPN profiles and IPSEC settings are exported/imported as\n                 zip files. They are encrypted with a static password.\n\n\n5) Hard-coded Vendor Accounts (CVE-2022-4333)\nThe `/etc/passwd` file and `/etc/shadow` file reveal hard-coded password\nhashes for the \"sprecon\" and \"spradm\" accounts. These accounts are shipped\nwith the update files (tested with official downloadable version 8.71) and\nthere seems to be no option for deleting or changing their passwords.\n\nThe usability of the accounts is configurable via the configuration.\nDetails to deactivate the accounts are included in the hardening guidelines.\n\n\n6) Decrypt Firmware Update Files (CVE-2025-41743)\nSPRECON firmware update files are encrypted. However, they use XOR magic\nand static passwords as encryption method. Due to limited time, we did\nnot reverse engineer the XOR algorithm and instead ran the decoding\nbinaries using QEMU. First, the fwimaker binary was run to create a\nregular zip file from the XORed .fwi file by running the following\ncommand:\n\n```\nqemu-arm -L /usr/arm-linux-gnueabihf ./fwimaker x sce_P9pu244_sc_864l_crypt.fwi extracted.zip\n```\n\nAfterwards the ZIP file can be decompressed and decrypted.\nAn attacker is now able to read the static password hashes and\nfurther analyze components of the PLC.\n\nAccording to the vendor, manipulated firmware update files cannot be\nflashed anymore, due to the usage of firmware signing.\n\n\n7) Insecure Transport Encryption (CVE-2025-41744)\nThe file `/etc/rbac/default.pem` contains a private key which is used\nfor the HTTPS encryption of the webserver. Further, the same key is used\nto encrypt the communication with the Sprecher Engineering Studio.\nAn attacker can use vulnerability 3 or 6 to obtain the private key\nand can then decrypt communication in a man-in-the-middle position.\nThe certificate has following fingerprint:\n\n```\nE9:AF:F4:F1:90:83:3C:5B:0B:E2:DF:E1:DF:31:69:B5:C1:EC:90:52\n```\n\nOne device using the same certificate was discovered on the internet.\n\nAccording to the vendor, those certificates are only used during initial\ncommissioning and users can find further information to change the certificates\nin the documentation/guideline \"SPRECON Grundh\u00e4rtung\" (basic hardening).\nThe vendor\u0027s hardening guide makes it "
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/19"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.sprecher-automation.com/"
        },
        {
          "url": "https://www.sprecher-automation.com/anfrage-sprecon"
        },
        {
          "url": "https://www.sprecher-automation.com/en/company"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/2022-12_Advisories.pdf"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511042_de.pdf"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511043_de.pdf"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511044_de.pdf"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260617-0 :: Multiple Critical Vulnerabilities in Sprecher Automation SPRECON-E-C/-E-P/-E-T3",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2022-4332",
              "type": "related"
            },
            {
              "destId": "CVE-2022-4333",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41741",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41742",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41743",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41744",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0368",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/19",
            "automated": true,
            "contentSha256": "5090538895e185dcc7127720faf216b67257c06163b3544d734b5679dbc589e5",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-17T05:51:31Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0368"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0368"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}