Skip to content
OpenAdvisories
Critical 1 exploited CVE ICSA-25-140-07 1 CVE

Schneider Electric Galaxy VS, Galaxy VL, Galaxy VXL (Update A)

Published May 13, 2025 · Updated Sep 24, 2025 · Revision 3

Vendor: Schneider Electric Product: Galaxy VL Product: Galaxy VS Product: Galaxy VXL

Summary

Schneider Electric is aware of a vulnerability disclosed on the Erlang/OTP's SSH Server
component used Schneider Electric Galaxy VS, VL, and VXL.Many vendors, including Schneider Electric, embed the Erlang/OTP's SSH Server in their offers.The Galaxy VS, Galaxy VL, Galaxy VXL products are 3-phase UPS for data centers and other business critical applications.Failure to apply the mitigation provided below may risk unauthenticated remote code execution (RCE), which could impact the monitoring capabilities of the UPS and potential UPS operation.

Vulnerabilities 1

  • Critical 10.0
    CVE-2025-32433 Exploited Public exploit EPSS 99%

    Erlang/OTP SSH Vulnerable to Pre-Authentication RCE

    Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.3, OTP-26.2.5.11, and OTP-25.3.2.20, a SSH server may allow an attacker to perform unauthenticated remote code execution (RCE). By exploiting a flaw in SSH protoc…

    Erlang Project OTP erlang erlang Debian Ubuntu Azure Linux Alpine
    KEV Jun 9, 2025

Revision history

  1. #3.0.0

    Added missing CVE and CWE

  2. #2.0.0

    Remediations are now available for Galaxy VS, Galaxy VL, and Galaxy VXL

  3. #1.0.0

    Original Release

References