GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

GCVE-1988-2026-0368

Vulnerability from gna-1988 – Published: 2026-09-11 07:55 – Updated: 2026-09-11 07:55
VLAI
Title
SEC Consult SA-20260617-0 :: Multiple Critical Vulnerabilities in Sprecher Automation SPRECON-E-C/-E-P/-E-T3
Summary
SEC Consult Vulnerability Lab Security Advisory < 20260617-0 > ======================================================================= title: Multiple Critical Vulnerabilities product: Sprecher Automation SPRECON-E-C/-E-P/-E-T3  vulnerable version: See vulnerable versions below fixed version: See solution section below          CVE number: CVE-2022-4333, CVE-2022-4332, CVE-2025-41741,                     CVE-2025-41742, CVE-2025-41743, CVE-2025-41744              impact: critical homepage:https://www.sprecher-automation.com/             found: 2022-08-26 by: Steffen Robertz Christian Hager (Office Vienna) SEC Consult Vulnerability Lab An integrated part of SEC Consult, an Atos business Europe | Asia https://www.sec-consult.com ======================================================================= Vendor description: ------------------- "Sprecher Automation provides products and solutions for power supply and process automation. We secure critical infrastructures and optimise complex energy and industry processes. [...] Quality, availability and security – those are not only our customers's requirements, but also goals we are striving for. Due to that, for example, the hard- and software development are located in Austria and Germany. We produce exclusively in Austria – starting with the production of single elements, to system checks and practical inhouse testing." Source:https://www.sprecher-automation.com/en/company Business recommendation: ------------------------ The vendor provides updated versions as well as workaround information in their security advisories. Users should verify whether the patches are installed already, otherwise patch immediately. SEC Consult highly recommends to perform a thorough security review of the product conducted by security professionals to identify and resolve potential further security issues. Vulnerability overview/description: ----------------------------------- 1) Leak of Firmware Signing Private Key (CVE-2025-41741) Sprecher signs its firmware update files to prevent an attacker from loading manipulated update files. However, each PLC contains the globally valid private signing key, as it is also used to sign backups. An attacker, who obtains the key is able to ship validly signed, modified firmware updates. The security vulnerability has been resolved in firmware version 9 and above. Further details can be found in the advisory of the vendor. In previous versions the affected feature can be deactivated by the customer. The stated key can only be used in conjunction with the backup feature. Affected products: SPRECON-E-C/-E-P/-E CPU Modul 2) Missing Secure-Boot Mechanism (CVE-2022-4332) The PLC is able to detect secure boot violations correctly. However, the events are not handled properly. They only output a warning to the boot log, but do not prevent the device's operation. Thus, anybody with physical access to the device can modify the firmware and potentially include backdoors. The security vulnerability has been resolved in firmware version 8.71a and above, as well as 8.64m. Further details can be found in the advisory of the vendor. In current and previous versions the affected feature can be deactivated by the customer. Affected products: SPRECON-E-C/-E-P/-E 3) Unencrypted External Flash Memory (CVE-2022-4332) The external flash memory can be dumped using tools such as the Xgecu T56. This allows an attacker with physical access to read all files and thus gain knowledge about sensitive files such as passwords and private keys. The security vulnerability has been resolved in firmware version 9 and above. Further details can be found in the advisory of the vendor. In current and previous versions the affected feature can be deactivated by the customer. Affected products: SPRECON-E-C/-E-P/-E-T3 4) Usage of static passwords (CVE-2025-41742) Various static passwords / key material can be discovered in the firmware. They serve different use cases, such as hard-coded user accounts, as well as encryption for settings and configuration files. This allows an attacker to decrypt configuration files, modify them and properly encrypt them again. According to the vendor, the documented static identity string does not serve a security purpose in the system and is used as an identifier for maintenance. Using the default identifier can lead to the targeted system being misidentified during maintenance. Affected products: SPRECON-E-C/-E-P/-E-T3 5) Hard-coded Vendor Accounts (CVE-2022-4333) Two hard-coded vendor accounts were revealed in the devices. These accounts are shipped with every update file and can be used by the vendor e.g. for support access. These documented accounts can be activated or deactivated in the configuration. These accounts are additionally secured with 2FA in firmware version 8.71g. Affected products: SPRECON-E-C/-E-P/-E-T3 6) Decrypt Firmware Update Files (CVE-2025-41743) Firmware update files include hard-coded accounts from vulnerability 5 and can be decrypted using an XOR algorithm and a static password. This allows an attacker to further analyze PLC components as well as gaining knowledge of private keys and hard-coded accounts without requiring physical access to any device. The signature and encryption mechanism have been modified and the security vulnerability has been resolved in version 8.71 and above. Further details can be found in the advisory of the vendor. Affected products: SPRECON-E-C/-E-P/-E-T3 7) Insecure Transport Encryption (CVE-2025-41744) The PLC's webserver and the connection to the Sprecher Engineering Center software use the same static default key on all devices. An attacker who gains access to the private key via vulnerability 3 or 6 can thus decrypt all traffic in a man-in-the-middle position. Thus, an attacker would be able to change configurations and read connection passwords. According to the vendor, those certificates are only used during initial commissioning and users can find further information to change the certificates in the documentation/guideline "SPRECON Grundhärtung" (basic hardening). The vendor's hardening guide makes it clear that it is both possible and recommended to change the default certificate. Documentation: 94.2.913.50en SPRECON Basic Hardening Proof of concept: ----------------- 1) Leak of Firmware Signing Private Key (CVE-2025-41741) Backups are restored by the same command flow as regular update files. Thus, backups need to be validly signed as well. For this, Sprecher's private key is required. The following openssl command signs the created backup: ``` openssl dgst -sha256 -sign ${SSM_CERT}/.backup.key -passinfile:${SSM_CERT}/.pass -out ${SSM_SECURE_DIR}/image.sha256 ${SSM_SECURE_DIR}/image.zip 2>/dev/null ``` The private key and password are both stored in the same filesystem and can be obtained via the decrypted firmware update file (vulnerability 6) or the unencrypted flash memory (vulnerability 3). 2) Missing Secure-Boot Mechanism (CVE-2022-4332) The main SoC of the SPRECON E-C-94 is an i.MX6. The board does not fully enable High-Assurance Boot (HAB). Thus, the firmware and bootloader can be modified. The modification is detected, however, since secure boot is not fully enabled, the violation will not be handled. The following boot log can be seen on the device's service connector (X6). The first bootline was manipulated to include the string "SECTEST". ``` REL_UBOOT_SECTEST_2015_07_RC7 SPL (Mar 11 2022 - 10:55:26) Booting from SPI Image Entry Point: 0x17800000 Image Load Address: 0x177FFFC0 Image Size: 0x48000 Authenticate image from DDR location 0x177fffc0... Authenticated Image Size = 0x46000 Load Addr = 0x17800000 HAB not enabled U-Boot Authentication Successful [...] Authenticate image from DDR location 0x12000000... Authenticated Image Size = 0x7bc000 HAB not enabled HAB Configuration: 0xf0, HAB State: 0x66 --------- HAB Event 1 ----------------- [...] zImage Authentication Successful ``` 3) Unencrypted External Flash Memory (CVE-2022-4332) The main memory is a BGA153 eMMC flash memory. Thus, it can be read by multiple tools such as the Xgecu T56. By dumping its contents, an attacker can extract password hashes from the `/etc/passwd` or `/etc/shadow` file and gain access to the private key from vulnerability 1. 4) Usage of static passwords (CVE-2025-41742)     4.1) Static Passwords in Sprecher Engineering Studio Two different passwords can be used to call an internal function. This can be seen in following code snippet: ``` iVar3 = _strcmp(local_28,"**redacted**"); if (((iVar3 == 0) || (iVar3 = _strcmp(local_28,"**redacted**"), iVar3 == 0)) ||(iVar3 = _strcmp(local_28,"**redacted**"), iVar3 == 0)) { FUN_10001780(local_28,0x20,"XXX"); } ``` Unfortunately, we were not able to fully determine the use case of these credentials. 4.2) Static Passwords in Sprecher Engineering Studio Configuration files When exporting configurations from the Engineering Studio, a .sprXecz file will be created. It is encrypted using a static password. 4.3) Webserver Settings Export The webserver exports its settings as .jzp file. However, this is just a renamed .zip file which uses a static password. 4.4) OpenVPN and IPSEC Settings Export/Import OpenVPN profiles and IPSEC settings are exported/imported as zip files. They are encrypted with a static password. 5) Hard-coded Vendor Accounts (CVE-2022-4333) The `/etc/passwd` file and `/etc/shadow` file reveal hard-coded password hashes for the "sprecon" and "spradm" accounts. These accounts are shipped with the update files (tested with official downloadable version 8.71) and there seems to be no option for deleting or changing their passwords. The usability of the accounts is configurable via the configuration. Details to deactivate the accounts are included in the hardening guidelines. 6) Decrypt Firmware Update Files (CVE-2025-41743) SPRECON firmware update files are encrypted. However, they use XOR magic and static passwords as encryption method. Due to limited time, we did not reverse engineer the XOR algorithm and instead ran the decoding binaries using QEMU. First, the fwimaker binary was run to create a regular zip file from the XORed .fwi file by running the following command: ``` qemu-arm -L /usr/arm-linux-gnueabihf ./fwimaker x sce_P9pu244_sc_864l_crypt.fwi extracted.zip ``` Afterwards the ZIP file can be decompressed and decrypted. An attacker is now able to read the static password hashes and further analyze components of the PLC. According to the vendor, manipulated firmware update files cannot be flashed anymore, due to the usage of firmware signing. 7) Insecure Transport Encryption (CVE-2025-41744) The file `/etc/rbac/default.pem` contains a private key which is used for the HTTPS encryption of the webserver. Further, the same key is used to encrypt the communication with the Sprecher Engineering Studio. An attacker can use vulnerability 3 or 6 to obtain the private key and can then decrypt communication in a man-in-the-middle position. The certificate has following fingerprint: ``` E9:AF:F4:F1:90:83:3C:5B:0B:E2:DF:E1:DF:31:69:B5:C1:EC:90:52 ``` One device using the same certificate was discovered on the internet. According to the vendor, those certificates are only used during initial commissioning and users can find further information to change the certificates in the documentation/guideline "SPRECON Grundhärtung" (basic hardening). The vendor's hardening guide makes it
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
unknown Sprecher Automation SPRECON-E-C/-E-P/-E-T3 Affected: unknown
guessed Create a notification for this product.
Credits
SEC Consult Vulnerability Lab via Fulldisclosure
Relationships
analysis GCVE-1988-2026-0368 (this record)
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Sprecher Automation SPRECON-E-C/-E-P/-E-T3",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory \u003c 20260617-0 \u003e\n=======================================================================\n              title: Multiple Critical Vulnerabilities\n            product: Sprecher Automation SPRECON-E-C/-E-P/-E-T3\n\u00a0vulnerable version: See vulnerable versions below\n      fixed version: See solution section below\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0CVE number: CVE-2022-4333, CVE-2022-4332, CVE-2025-41741,\n \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 CVE-2025-41742, CVE-2025-41743, CVE-2025-41744\n\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0impact: critical\n           homepage:https://www.sprecher-automation.com/\n  \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0 found: 2022-08-26\n                 by: Steffen Robertz\n                     Christian Hager (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n=======================================================================\n\nVendor description:\n-------------------\n\"Sprecher Automation provides products and solutions for power supply\nand process automation. We secure critical infrastructures and optimise\ncomplex energy and industry processes. [...]\nQuality, availability and security \u2013 those are not only our customers\u0027s\nrequirements, but also goals we are striving for. Due to that, for example,\nthe hard- and software development are located in Austria and Germany.\nWe produce exclusively in Austria \u2013 starting with the production of\nsingle elements, to system checks and practical inhouse testing.\"\n\nSource:https://www.sprecher-automation.com/en/company\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides updated versions as well as workaround information in\ntheir security advisories. Users should verify whether the patches are\ninstalled already, otherwise patch immediately.\n\nSEC Consult highly recommends to perform a thorough security review of\nthe product conducted by security professionals to identify and resolve\npotential further security issues.\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Leak of Firmware Signing Private Key (CVE-2025-41741)\nSprecher signs its firmware update files to prevent an attacker from\nloading manipulated update files. However, each PLC contains the\nglobally valid private signing key, as it is also used to sign backups.\nAn attacker, who obtains the key is able to ship validly signed,\nmodified firmware updates.\n\nThe security vulnerability has been resolved in firmware version 9 and\nabove. Further details can be found in the advisory of the vendor. In\nprevious versions the affected feature can be deactivated by the customer.\nThe stated key can only be used in conjunction with the backup feature.\nAffected products: SPRECON-E-C/-E-P/-E CPU Modul\n\n2) Missing Secure-Boot Mechanism (CVE-2022-4332)\nThe PLC is able to detect secure boot violations correctly. However,\nthe events are not handled properly. They only output a warning to the\nboot log, but do not prevent the device\u0027s operation. Thus, anybody with\nphysical access to the device can modify the firmware and potentially\ninclude backdoors.\n\nThe security vulnerability has been resolved in firmware version 8.71a and\nabove, as well as 8.64m. Further details can be found in the advisory\nof the vendor. In current and previous versions the affected feature can be\ndeactivated by the customer.\nAffected products: SPRECON-E-C/-E-P/-E\n\n3) Unencrypted External Flash Memory (CVE-2022-4332)\nThe external flash memory can be dumped using tools such as the Xgecu\nT56. This allows an attacker with physical access to read all files and\nthus gain knowledge about sensitive files such as passwords and private\nkeys.\n\nThe security vulnerability has been resolved in firmware version 9 and above.\nFurther details can be found in the advisory of the vendor. In current and\nprevious versions the affected feature can be deactivated by the customer.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n4) Usage of static passwords (CVE-2025-41742)\nVarious static passwords / key material can be discovered in the firmware.\nThey serve  different use cases, such as hard-coded user accounts, as well as\nencryption for settings and configuration files. This allows an attacker\nto decrypt configuration files, modify them and properly encrypt them\nagain.\n\nAccording to the vendor, the documented static identity string does not serve\na security purpose in the system and is used as an identifier for maintenance.\nUsing the default identifier can lead to the targeted system being misidentified\nduring maintenance.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n5) Hard-coded Vendor Accounts (CVE-2022-4333)\nTwo hard-coded vendor accounts were revealed in the devices. These\naccounts are shipped with every update file and can be used by the\nvendor e.g. for support access.\n\nThese documented accounts can be activated or deactivated in the configuration.\nThese accounts are additionally secured with 2FA in firmware version 8.71g.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n6) Decrypt Firmware Update Files (CVE-2025-41743)\nFirmware update files include hard-coded accounts from vulnerability 5 and\ncan be decrypted using an XOR algorithm and a static password. This\nallows an attacker to further analyze PLC components as well as gaining\nknowledge of private keys and hard-coded accounts without requiring\nphysical access to any device.\n\nThe signature and encryption mechanism have been modified and the security\nvulnerability has been resolved in version 8.71 and above. Further details\ncan be found in the advisory of the vendor.\nAffected products: SPRECON-E-C/-E-P/-E-T3\n\n7) Insecure Transport Encryption (CVE-2025-41744)\nThe PLC\u0027s webserver and the connection to the Sprecher Engineering Center\nsoftware use the same static default key on all devices. An attacker who gains\naccess to the private key via vulnerability 3 or 6 can thus decrypt all\ntraffic in a man-in-the-middle position. Thus, an attacker would be\nable to change configurations and read connection passwords.\n\nAccording to the vendor, those certificates are only used during initial\ncommissioning and users can find further information to change the certificates\nin the documentation/guideline \"SPRECON Grundh\u00e4rtung\" (basic hardening).\nThe vendor\u0027s hardening guide makes it clear that it is both possible and\nrecommended to change the default certificate.\nDocumentation: 94.2.913.50en SPRECON Basic Hardening\n\n\nProof of concept:\n-----------------\n1) Leak of Firmware Signing Private Key (CVE-2025-41741)\nBackups are restored by the same command flow as regular update files.\nThus, backups need to be validly signed as well. For this, Sprecher\u0027s\nprivate key is required. The following openssl command signs the\ncreated backup:\n\n```\nopenssl dgst -sha256 -sign ${SSM_CERT}/.backup.key -passinfile:${SSM_CERT}/.pass -out\n${SSM_SECURE_DIR}/image.sha256 ${SSM_SECURE_DIR}/image.zip 2\u003e/dev/null\n```\n\nThe private key and password are both stored in the same filesystem and\ncan be obtained via the decrypted firmware update file (vulnerability 6)\nor the unencrypted flash memory (vulnerability 3).\n\n\n2) Missing Secure-Boot Mechanism (CVE-2022-4332)\nThe main SoC of the SPRECON E-C-94 is an i.MX6. The board does not fully\nenable High-Assurance Boot (HAB). Thus, the firmware and bootloader can\nbe modified. The modification is detected, however, since secure boot is\nnot fully enabled, the violation will not be handled. The following boot\nlog  can be seen on the device\u0027s service connector (X6). The first\nbootline was manipulated to include the string \"SECTEST\".\n\n```\nREL_UBOOT_SECTEST_2015_07_RC7 SPL (Mar 11 2022 - 10:55:26)\nBooting from SPI\nImage Entry Point: 0x17800000\nImage Load Address: 0x177FFFC0\nImage Size: 0x48000\nAuthenticate image from DDR location 0x177fffc0...\nAuthenticated Image Size = 0x46000\nLoad Addr = 0x17800000\nHAB not enabled\nU-Boot Authentication Successful\n[...]\nAuthenticate image from DDR location 0x12000000...\nAuthenticated Image Size = 0x7bc000\nHAB not enabled\nHAB Configuration: 0xf0, HAB State: 0x66\n--------- HAB Event 1 -----------------\n[...]\nzImage Authentication Successful\n```\n\n3) Unencrypted External Flash Memory (CVE-2022-4332)\nThe main memory is a BGA153 eMMC flash memory. Thus, it can be read by\nmultiple tools such as the Xgecu T56. By dumping its contents, an\nattacker can extract password hashes from the `/etc/passwd` or\n`/etc/shadow` file and gain access to the private key from\nvulnerability 1.\n\n\n4) Usage of static passwords (CVE-2025-41742)\n\u00a0 \u00a0 4.1) Static Passwords in Sprecher Engineering Studio\n                 Two different passwords can be used to call an internal function.\n         This can be seen in following code snippet:\n                \n                 ```\n                 iVar3 = _strcmp(local_28,\"**redacted**\");\n                 if (((iVar3 == 0) || (iVar3 = _strcmp(local_28,\"**redacted**\"), iVar3 == 0)) ||(iVar3 = \n_strcmp(local_28,\"**redacted**\"), iVar3 == 0)) {\n                        FUN_10001780(local_28,0x20,\"XXX\");\n                 }\n                 ```\n                \n                 Unfortunately, we were not able to fully determine the use case of\n         these credentials.\n        \n        4.2) Static Passwords in Sprecher Engineering Studio Configuration files\n                 When exporting configurations from the Engineering Studio, a .sprXecz\n                 file will be created. It is encrypted using a static password.\n\n        4.3) Webserver Settings Export\n                 The webserver exports its settings as .jzp file. However, this\n                 is just a renamed .zip file which uses a static password.\n\n        4.4) OpenVPN and IPSEC Settings Export/Import\n                 OpenVPN profiles and IPSEC settings are exported/imported as\n                 zip files. They are encrypted with a static password.\n\n\n5) Hard-coded Vendor Accounts (CVE-2022-4333)\nThe `/etc/passwd` file and `/etc/shadow` file reveal hard-coded password\nhashes for the \"sprecon\" and \"spradm\" accounts. These accounts are shipped\nwith the update files (tested with official downloadable version 8.71) and\nthere seems to be no option for deleting or changing their passwords.\n\nThe usability of the accounts is configurable via the configuration.\nDetails to deactivate the accounts are included in the hardening guidelines.\n\n\n6) Decrypt Firmware Update Files (CVE-2025-41743)\nSPRECON firmware update files are encrypted. However, they use XOR magic\nand static passwords as encryption method. Due to limited time, we did\nnot reverse engineer the XOR algorithm and instead ran the decoding\nbinaries using QEMU. First, the fwimaker binary was run to create a\nregular zip file from the XORed .fwi file by running the following\ncommand:\n\n```\nqemu-arm -L /usr/arm-linux-gnueabihf ./fwimaker x sce_P9pu244_sc_864l_crypt.fwi extracted.zip\n```\n\nAfterwards the ZIP file can be decompressed and decrypted.\nAn attacker is now able to read the static password hashes and\nfurther analyze components of the PLC.\n\nAccording to the vendor, manipulated firmware update files cannot be\nflashed anymore, due to the usage of firmware signing.\n\n\n7) Insecure Transport Encryption (CVE-2025-41744)\nThe file `/etc/rbac/default.pem` contains a private key which is used\nfor the HTTPS encryption of the webserver. Further, the same key is used\nto encrypt the communication with the Sprecher Engineering Studio.\nAn attacker can use vulnerability 3 or 6 to obtain the private key\nand can then decrypt communication in a man-in-the-middle position.\nThe certificate has following fingerprint:\n\n```\nE9:AF:F4:F1:90:83:3C:5B:0B:E2:DF:E1:DF:31:69:B5:C1:EC:90:52\n```\n\nOne device using the same certificate was discovered on the internet.\n\nAccording to the vendor, those certificates are only used during initial\ncommissioning and users can find further information to change the certificates\nin the documentation/guideline \"SPRECON Grundh\u00e4rtung\" (basic hardening).\nThe vendor\u0027s hardening guide makes it "
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-11T07:55:58Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/19"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jun/19"
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://www.sprecher-automation.com/"
        },
        {
          "url": "https://www.sprecher-automation.com/anfrage-sprecon"
        },
        {
          "url": "https://www.sprecher-automation.com/en/company"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/2022-12_Advisories.pdf"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511042_de.pdf"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511043_de.pdf"
        },
        {
          "url": "https://www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511044_de.pdf"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jun/19"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260617-0 :: Multiple Critical Vulnerabilities in Sprecher Automation SPRECON-E-C/-E-P/-E-T3",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2022-4332",
              "type": "related"
            },
            {
              "destId": "CVE-2022-4333",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41741",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41742",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41743",
              "type": "related"
            },
            {
              "destId": "CVE-2025-41744",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0368",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jun/19",
            "automated": true,
            "contentSha256": "5090538895e185dcc7127720faf216b67257c06163b3544d734b5679dbc589e5",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jun/19",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-06-17T05:51:31Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0368"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-11T07:55:58Z",
    "dateUpdated": "2026-09-11T07:55:58Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0368"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.