Description
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able to capture local SMB traffic between a valid user within the BMS network and the vulnerable products.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Eelctric | EcoStruxure Building Operation Enterprise Server | All 7.x versions – < 7.0.2.348, All 6.x versions – < 6.0.4.10001 (CP8), All 5.x versions – < 5.0.3.17009 (CP16) | 7.0.2.348 |
| Schneider Electric | EcoStruxure Enterprise Server | All 7.x versions – < 7.0.2.348, All 6.x versions – < 6.0.4.10001 (CP8), All 5.x versions – < 5.0.3.17009 (CP16) | 7.0.2.348 |
| Schneider Eelctric | EcoStruxure Building Operation Workstation | All 7.x versions – < 7.0.2.348, All 6.x versions – < 6.0.4.10001 (CP8), All 5.x versions – < 5.0.3.17009 (CP16) | 7.0.2.348 |
Advisories 2
- ICSA-25-254-08 Schneider Electric EcoStruxure CISA ICS & IT advisories · Sep 9, 2025
- SEVD-2025-224-04 EcoStruxure™ Building Operation Enterprise Server, EcoStruxure™ Building Operation Enterprise Central, and EcoStruxure™ Workstation Schneider Electric CPCERT · Sep 9, 2025