Skip to content
OpenAdvisories
Critical · 9.8 CVE-2025-1960 EUVD-2025-6405GHSA-5mrq-42cr-23mg

CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized c…

Published Mar 12, 2025 · Updated Mar 13, 2025 · Assigned by schneider

Vendor: Schneider Electric Product: WebHMI – Deployed with EcoStruxure Power Automation System Category: ICS / OT

Description

CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an
attacker to execute unauthorized commands when a system’s default password credentials have not been
changed on first use. The default username is not displayed correctly in the WebHMI interface.

Affected products

VendorProductAffectedFixed
Schneider Electric WebHMI – Deployed with EcoStruxure Power Automation System WebHMI v4.1.0.0 and prior when deployed with EPAS User Interface 2.6.30.19 and prior —

Advisories 2

References