CVE-2025-0327: high-severity vulnerability in Schneider Electric EcoStruxure Process Expert
Published
Follow this CVE+ Monitor EcoStruxure Process Expert+ Monitor EcoStruxure Process Expert for AVEVA System Platform
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.5epss 0.2%
CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit
trail data and the other acting as server managing client request) that could cause a loss of Confidentiality,
Integrity and Availability of engineering workstation when an attacker with standard privilege modifies the
executable path of the windows services. To be exploited, services need to be restarted.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
Schneider Electric · EcoStruxure Process ExpertSchneider Electric · EcoStruxure Process Expert for AVEVA System PlatformRelated CVEs — Schneider Electric EcoStruxure Process Expert
In the same product, most dangerous first.