What’s Vulnerable › Vulnerabilities

CVE-2025-7746

• Severity: medium (CVSS 5.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-09-09 · updated 2026-06-17
• Weakness: CWE-79

Description

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected by a malicious user potentially leading to modify or read data in a victim’s browser.

Affected products

• Schneider Electric ATS490 Altivar Soft Starter: all versions
• Schneider Electric ATV340E Altivar Machine Drives: all versions
• Schneider Electric ATV6000 Medium Voltage Altivar Process Drives: all versions
• Schneider Electric ATV630/650/660/680/6A0/6B0/6L0 Altivar Process Drives: all versions
• Schneider Electric ATV930/950/955/960/980/9A0/9B0/9L0/991/992/993 Altivar Process Drives: all versions
• Schneider Electric ILC992 InterLink Converter: all versions
• Schneider Electric VW3A3530D: ATVdPAC module: before v25.0 — fixed in v25.0
• Schneider Electric VW3A3720 & VW3A3721 Altivar Process Communication Modules: all versions

How to fix

Upgrade to a fixed version: Schneider Electric VW3A3530D: ATVdPAC module v25.0. Check the vendor advisory for mitigations.

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-252-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-252-01.pdf
• http://seclists.org/fulldisclosure/2025/Sep/69

Get alerted when CVE-2025-7746 or the next vulnerability affects your stack