Description
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause an unvalidated data injected by a malicious user potentially leading to modify or read data in a victim’s browser.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | ATV630/650/660/680/6A0/6B0/6L0 Altivar Process Drives | all versions | — |
| Schneider Electric | ATV930/950/955/960/980/9A0/9B0/9L0/991/992/993 Altivar Process Drives | all versions | — |
| Schneider Electric | ILC992 InterLink Converter | all versions | — |
| Schneider Electric | ATV340E Altivar Machine Drives | all versions | — |
| Schneider Electric | ATV6000 Medium Voltage Altivar Process Drives | all versions | — |
| Schneider Electric | ATS490 Altivar Soft Starter | all versions | — |
| Schneider Electric | VW3A3720 & VW3A3721 Altivar Process Communication Modules | all versions | — |
| Schneider Electric | VW3A3530D: ATVdPAC module | all versions – < v25.0 | v25.0 |
Advisories 2
- SEVD-2025-252-01 Multiple Altivar Process Drives and Communication Modules Schneider Electric CPCERT · Oct 13, 2026
- ICSA-25-259-01 Schneider Electric Altivar Products, ATVdPAC Module, ILC992 InterLink Converter (Update B) CISA ICS & IT advisories · May 26, 2026