Skip to content
CVE PROGRAM SOURCE RECORD8.5 High

CVE-2025-11739

CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
schneider

Description

CWE‑502: Deserialization of Untrusted Data vulnerability exists that could cause arbitrary code execution with administrative privileges when a locally authenticated attacker sends a crafted data stream, triggering unsafe deserialization.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Schneider Electric EcoStruxure™ Power Monitoring Expert (PME)

Default version status: unaffected

  • Version 2022affected
  • Version 2023affected
  • Version 2023 R2affected
  • Version 2024affected
  • Version 2024 R2affected

Schneider Electric EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module

Default version status: unaffected

  • Version 2022affected
  • Version 2024affected

References