Schneider Electric EcoStruxureâ„¢ Power Monitoring Expert
En bref
- Source
- NVD
- EPSS
- EPSS 0.33 % · centile 26 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- schneider
- Statut NVD
- Deferred
Description
A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that exposes TGML diagram resources to the wrong control sphere, providing other authenticated users with potentially inappropriate access to TGML diagrams.
Faiblesses (CWE)
- CWE-668 — Exposition d'une ressource à la mauvaise sphère
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 4.0 | MEDIUM 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | schneider |
| CVSS 4.0 | MEDIUM 5.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X | NVD · cybersecurity@se.com (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2025-21131
- GCVE · GCVE-0-2025-6788
Avis du CERT-FR
- CERTFR-2025-AVI-0565 — Multiples vulnérabilités dans les produits Schneider Electric · cert.ssi.gouv.fr
Produits affectés
| Produit | Versions |
|---|---|
| Schneider Electric · EcoStruxure™ Power Monitoring Expert | affected 2023 < All ; affected 2023 R2 < All ; affected 2024 < All ; affected 2024 R2 < All |
| Schneider Electric · EcoStruxure™ Power Operation Advanced Reporting and Dashboards Module | affected 2022 w/ Advanced Reporting Module < All ; affected 2024 w/ Advanced Reporting Module < All |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |