Description
CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial of service when an authenticated user sends a specially crafted request to a specific endpoint from within the BMS network.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schnieder Electric | EcoStruxure Building Operation Enterprise Server | All 7.x versions – < 7.0.2.348, All 5.x versions – < 5.0.3.17009 (CP16) | 7.0.2.348 |
| Schneider Electric | EcoStruxure Enterprise Server | All 6.x versions – < 6.0.4.10001 (CP8), All 5.x versions – < 5.0.3.17009 (CP16) | 6.0.4.10001 (CP8) |
| Schneider Eelctric | EcoStruxure Building Operation Workstation | All 7.x versions – < 7.0.2.348, All 6.x versions – < 6.0.4.10001 (CP8), All 5.x versions – < 5.0.3.17009 (CP16) | 7.0.2.348 |
Advisories 2
- ICSA-25-254-08 Schneider Electric EcoStruxure CISA ICS & IT advisories · Sep 9, 2025
- SEVD-2025-224-04 EcoStruxure™ Building Operation Enterprise Server, EcoStruxure™ Building Operation Enterprise Central, and EcoStruxure™ Workstation Schneider Electric CPCERT · Sep 9, 2025