Summary
Schneider Electric is aware of vulnerabilities in its ConneXium Network Manager software.
The ConneXium Network Manager software provides a solution for configuring and monitoring the
administrable Schneider Electric devices, including switches, routers, firewalls, ConneXium Wi-Fi devices, and
products from various manufacturers.
Failure to apply the mitigations below may risk sensitive data disclosure, leading privilege escalation through
man-in-the-middle attacks on ConneXion Network Manager, denial of service, and remote code execution on
engineering workstations.
Vulnerabilities 2
-
High 7.8
CWE-552: Files or Directories Accessible to External Parties vulnerability over https exists that could leak informatio…
-
High 7.8
CWE-20: Improper Input Validation vulnerability exists that could cause a loss of Confidentiality, Integrity and Availa…
Revision history
-
#1.0.0
Original Release
References
-
ConneXium Network Manager Software - SEVD-2025-098-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-098-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2025-098-01.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390
-
ICS Advisory ICSA-25-107-03 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-25-107-03
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B