CVE-2025-8449

Severity: medium (CVSS 4.1 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-20 · updated 2026-06-17
Weakness: CWE-400

Description

CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network.

Affected products

Schneider Electric EcoStruxure Enterprise Server: from All 6.x versions before 6.0.4.10001 (CP8); from All 5.x versions before 5.0.3.17009 (CP16) — fixed in 5.0.3.17009 (CP16), 6.0.4.10001 (CP8)
Schneider Eelctric EcoStruxure Building Operation Workstation: from All 7.x versions before 7.0.2.348; from All 6.x versions before 6.0.4.10001 (CP8); from All 5.x versions before 5.0.3.17009 (CP16) — fixed in 5.0.3.17009 (CP16), 6.0.4.10001 (CP8), 7.0.2.348
Schnieder Electric EcoStruxure Building Operation Enterprise Server: from All 7.x versions before 7.0.2.348; from All 5.x versions before 5.0.3.17009 (CP16) — fixed in 5.0.3.17009 (CP16), 7.0.2.348

How to fix

Upgrade to a fixed version: Schneider Electric EcoStruxure Enterprise Server 5.0.3.17009 (CP16), 6.0.4.10001 (CP8); Schneider Eelctric EcoStruxure Building Operation Workstation 5.0.3.17009 (CP16), 6.0.4.10001 (CP8), 7.0.2.348; Schnieder Electric EcoStruxure Building Operation Enterprise Server 5.0.3.17009 (CP16), 7.0.2.348. Check the vendor advisory for mitigations.

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-224-04.pdf

Get alerted when CVE-2025-8449 or the next vulnerability affects your stack