Schneider Electric EcoStruxureâ„¢ Power Monitoring Expert
At a glance
- Source
- NVD
- EPSS
- EPSS 0.33 % · percentile 26 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- schneider
- NVD status
- Deferred
Description
A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providing other authenticated users with potentially inappropriate access to TGML diagrams.
Weaknesses (CWE)
- CWE-668 — Exposure of Resource to Wrong Sphere
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | schneider |
| CVSS 4.0 | MEDIUM 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · cybersecurity@se.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-21131
- GCVE · GCVE-0-2025-6788
CERT-FR advisories
- CERTFR-2025-AVI-0565 — Multiples vulnérabilités dans les produits Schneider Electric · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| Schneider Electric · EcoStruxure™ Power Monitoring Expert | affected 2023 < All ; affected 2023 R2 < All ; affected 2024 < All ; affected 2024 R2 < All |
| Schneider Electric · EcoStruxure™ Power Operation Advanced Reporting and Dashboards Module | affected 2022 w/ Advanced Reporting Module < All ; affected 2024 w/ Advanced Reporting Module < All |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |