External risk intelligence

Sprecher Automation SPRECON-E Default Keys Expose Communications

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2025-41744

The affected products are industrial control system (ICS) devices used in power automation and electrical grids. While network-reachable, these devices are typically deployed within segmented, internal operational technology (OT) networks behind firewalls or gateways, making direct public internet exposure uncommon and contrary to standard secure deployment practices.

Sprecher Automation Sprecon E C Firmware

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability has been identified in Sprecher Automation's SPRECON-E series devices, impacting their ability to secure communications. This issue stems from the use of default cryptographic keys, which could allow unauthorized remote access to encrypted data, potentially compromising its confidentiality and integrity.

Weak default keys expose encrypted communications.
Critical industrial systems face potential data compromise.
Confirm relevance and assess exposure to this vulnerability.

Attack Path

How an attacker could exploit the issue

An unprivileged attacker could remotely access all encrypted communications by exploiting default cryptographic keys. This compromise could affect the confidentiality and integrity of sensitive data.

No special access required.
Default cryptographic keys allow access.
Compromises confidentiality and integrity.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an unprivileged remote attacker could access all encrypted communications within Sprecher Automations SPRECON-E series devices due to the use of default cryptographic keys. This could compromise the confidentiality and integrity of the data transmitted.

Encrypted communications data.
Unauthenticated network access.
Compromised data confidentiality and integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-world ownership for this critical vulnerability likely falls to teams managing industrial control systems (ICS) and operational technology (OT) environments, potentially including infrastructure, network, and security operations teams, as well as vendor management if third-party integration is involved. The first practical step is to identify all Sprecher Automation SPRECON-E devices, determine their network exposure and criticality within your OT environment, and then engage the accountable ICS/OT owner to plan a coordinated remediation strategy.

ICS/OT infrastructure teams own the issue.
Verify device network reachability and criticality.
Coordinate vendor engagement for remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Sprecher Automation SPRECON-E series?

The SPRECON-E series consists of industrial control system devices manufactured by Sprecher Automation. These products are specialized hardware used for power automation, electrical grid management, and monitoring critical infrastructure processes. They rely on secure communication channels to transmit operational data between components safely.

What does CWE-1394 mean for CVE-2025-41744?

This vulnerability is classified as CWE-1394, which refers to the use of hardcoded or default cryptographic keys. In the context of this CVE, it means the devices come with pre-set security keys that are common across installations rather than being uniquely generated. Because these keys are effectively public knowledge, they fail to protect the data they are supposed to encrypt.

How does an attacker trigger this vulnerability?

An attacker triggers the vulnerability by establishing network communication with an affected device. Because the system uses default keys, no authentication or special privileges are required to decrypt the traffic. It is important to note that this is not triggered by a specific user action or software update; it is an inherent weakness in how the device handles secure communication protocols by default.

Is my SPRECON-E device at risk from the internet?

According to Halo Surface Signal, while these devices are network-reachable, they are typically found within isolated internal operational technology networks protected by firewalls. Direct exposure to the public internet is considered uncommon and contrary to standard deployment practices, which helps limit the potential attack surface for most organizations.

What should I do if I use these devices?

The first step is to create an inventory of all SPRECON-E units in your environment to understand where they are deployed. Once identified, evaluate their specific network connectivity and operational criticality. Finally, coordinate with the teams responsible for your industrial control systems to verify if a vendor-provided update is available to rotate or update these cryptographic keys.

References

www.sprecher-automation.com/fileadmin/itSecurity/PDF/SPR-2511043_de.pdf

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.