What’s Vulnerable › Vulnerabilities

CVE-2025-6625

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-18 · updated 2026-06-17
• Weakness: CWE-20

Description

CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device.

Affected products

• Schneider Electric BMXNGD0100: M580 Global Data module: all versions
• Schneider Electric BMXNOC0401: Modicon M340 X80 Ethernet Communication modules: all versions
• Schneider Electric BMXNOE0100: Modbus/TCP Ethernet Modicon M340 module: Versions prior to 3.60
• Schneider Electric BMXNOE0110: Modbus/TCP Ethernet Modicon M340 FactoryCast module: Versions prior to 6.80
• Schneider ELectric BMXNOR0200H: Ethernet / Serial RTU Module: all versions
• Schneider Electric SE Modicon M340: all versions

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-05.pdf

Get alerted when CVE-2025-6625 or the next vulnerability affects your stack