Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2025-0327

CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
schneider

Description

CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as server managing client request) that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when an attacker with standard privilege modifies the executable path of the windows services. To be exploited, services need to be restarted.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Schneider Electric EcoStruxure Process Expert

Default version status: unaffected

  • Versions 2020R2affected
  • Versions 2021 & 2023 (prior to v4.8.0.5715)affected

Schneider Electric EcoStruxure Process Expert for AVEVA System Platform

Default version status: unaffected

  • Versions 2020R2affected
  • Versions 2021 & 2023affected

References