CveMateVulnerability intelligence

Schneider Electric vulnerabilities, page 2

320 vulnerabilities

Known vulnerabilities in Schneider Electric products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 306 products.

CVE-2025-2223schneider electricconnexium network manager1y ago09-04-2025 10:16

CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when a malicious project file is loaded by a user from the local system.CVE-2025-2441schneider electrictrio q licensed data radio1y ago09-04-2025 10:23

CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could lead to loss of confidentiality when a malicious user, having physical access, sets the radio in factory default mode where the product does not correctly initialize all data.CVE-2025-2875schneider electricmodicon controllers m241 / m251+11y ago14-05-2025 08:46

CWE-610: Externally Controlled Reference to a Resource in Another Sphere vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates controller’s webserver URL to access resources.CVE-2025-13905schneider electricecostruxure™ process expert+18mo ago29-01-2026 15:20

CWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or more executable service binaries are modified in the installation folder by a local user with normal privilege upon service restart.CVE-2025-13901schneider electricmodicon m241/m251+47mo ago10-03-2026 17:02

CWE-404 Improper Resource Shutdown or Release vulnerability exists that could cause partial Denial of Service on Machine Expert protocol when an unauthenticated attacker sends malicious payload to occupy active communication channels.CVE-2025-13902schneider electricmodicon controllers m241/m251+57mo ago10-03-2026 17:06

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause condition where authenticated attackers can have a victim’s browser run arbitrary JavaScript when the victim hovers over a maliciously crafted element on a web server containing the injected payload.CVE-2025-13957schneider electricecostruxure™ it data center expert (formerly known as struxureware data center expert)7mo ago10-03-2026 12:19

CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause information disclosure and remote code execution when SOCKS Proxy is enabled, and administrator credentials and PostgreSQL database credentials are known. SOCKS Proxy is disabled by default.CVE-2025-13845schneider electricecostruxure power build rapsody+19mo ago15-01-2026 18:33

CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file) into Rapsody.CVE-2025-13844schneider electricecostruxure power build rapsody+19mo ago15-01-2026 18:28

CWE-415: Double Free vulnerability exists that could cause heap memory corruption when the end user imports a malicious project file (SSD file) shared by the attacker into Rapsody.CVE-2025-1058schneider electricasco 5310 single-channel remote annunciator+11y ago13-02-2025 05:45

CWE-494: Download of Code Without Integrity Check vulnerability exists that could render the device inoperable when malicious firmware is downloaded.CVE-2025-1960schneider electricwebhmi – deployed with ecostruxure power automation system1y ago12-03-2025 15:33

CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a system’s default password credentials have not been changed on first use. The default username is not displayed correctly in the WebHMI interface.CVE-2025-1070schneider electricasco 5310 single-channel remote annunciator+11y ago13-02-2025 05:55

CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could render the device inoperable when a malicious file is downloaded.CVE-2025-1060schneider electricasco 5310 single-channel remote annunciator+11y ago13-02-2025 05:53

CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists that could result in the exposure of data when network traffic is being sniffed by an attacker.CVE-2025-1059schneider electricasco 5310 single-channel remote annunciator+11y ago13-02-2025 05:49

CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious packets are sent to the webserver of the device.CVE-2025-11566schneider electricpowerchute™ serial shutdown11mo ago12-11-2025 13:26

CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that would allow an attacker on the local network to gain access to the user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint.CVE-2025-11567schneider electricpowerchute™ serial shutdown11mo ago12-11-2025 13:27

CWE-276: Incorrect Default Permissions vulnerability exists that could cause elevated system access when the target installation folder is not properly secured.CVE-2025-11565schneider electricpowerchute™ serial shutdown11mo ago12-11-2025 13:19

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause elevated system access when a Web Admin user on the local network tampers with the POST /REST/UpdateJRE request payload.CVE-2025-11739schneider electricecostruxure™ power monitoring expert (pme)+37mo ago10-03-2026 12:25

CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.CVE-2025-0816schneider electricenerlin’x eife (lv851001)+11y ago13-02-2025 06:38

CWE-20: Improper Input Validation vulnerability exists that could cause Denial-of-Service of the product when malicious IPV6 packets are sent to the device.CVE-2025-0813schneider electricecostruxure power automation system user interface (epas-ui) - secured versions1y ago12-03-2025 15:30

CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized user without permission rights has physical access to the EPAS-UI computer and is able to reboot the workstation and interrupt the normal boot process.