Schneider Electric Ecostruxure™ Power Operation (Epo) Advanced Reporting And Dashboards Module vulnerabilities
6 vulnerabilities
Known vulnerabilities in Schneider Electric Ecostruxure™ Power Operation (Epo) Advanced Reporting And Dashboards Module, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-54927schneider electricecostruxure™ power monitoring expert (pme)+1
EPSS score0.60%
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized access to sensitive files when an authenticated attackers uses a crafted path input that is processed by the system.CVE-2025-54926schneider electricecostruxure™ power monitoring expert (pme)+1EPSS score0.91%
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause remote code execution when an authenticated attacker with admin privileges uploads a malicious file over HTTP which then gets executed.CVE-2025-54925schneider electricecostruxure™ power monitoring expert (pme)+1EPSS score0.45%
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the application to access a malicious url.CVE-2025-54923schneider electricecostruxure™ power monitoring expert (pme)+1EPSS score0.68%
CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated users send crafted data to a network-exposed service that performs unsafe deserialization.CVE-2025-54924schneider electricecostruxure™ power monitoring expert (pme)+1EPSS score0.45%
CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized access to sensitive data when an attacker sends a specially crafted document to a vulnerable endpoint.CVE-2025-11739schneider electricecostruxure™ power monitoring expert (pme)+3EPSS score0.19%
CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.