CVE-2025-8448

Severity: low (CVSS 1.0 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-20 · updated 2026-06-17
Weakness: CWE-200

Description

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able to capture local SMB traffic between a valid user within the BMS network and the vulnerable products.

Affected products

Schneider Electric EcoStruxure Enterprise Server: from All 7.x versions before 7.0.2.348; from All 6.x versions before 6.0.4.10001 (CP8); from All 5.x versions before 5.0.3.17009 (CP16) — fixed in 5.0.3.17009 (CP16), 6.0.4.10001 (CP8), 7.0.2.348
Schneider Eelctric EcoStruxure Building Operation Enterprise Server: from All 7.x versions before 7.0.2.348; from All 6.x versions before 6.0.4.10001 (CP8); from All 5.x versions before 5.0.3.17009 (CP16) — fixed in 5.0.3.17009 (CP16), 6.0.4.10001 (CP8), 7.0.2.348
Schneider Eelctric EcoStruxure Building Operation Workstation: from All 7.x versions before 7.0.2.348; from All 6.x versions before 6.0.4.10001 (CP8); from All 5.x versions before 5.0.3.17009 (CP16) — fixed in 5.0.3.17009 (CP16), 6.0.4.10001 (CP8), 7.0.2.348

How to fix

Upgrade to a fixed version: Schneider Electric EcoStruxure Enterprise Server 5.0.3.17009 (CP16), 6.0.4.10001 (CP8), 7.0.2.348; Schneider Eelctric EcoStruxure Building Operation Enterprise Server 5.0.3.17009 (CP16), 6.0.4.10001 (CP8), 7.0.2.348; Schneider Eelctric EcoStruxure Building Operation Workstation 5.0.3.17009 (CP16), 6.0.4.10001 (CP8), 7.0.2.348. Check the vendor advisory for mitigations.

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-04.pdf

Get alerted when CVE-2025-8448 or the next vulnerability affects your stack