Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2025-54923

CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated users send crafted data

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
schneider

Description

CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution and compromise of system integrity when authenticated users send crafted data to a network-exposed service that performs unsafe deserialization.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Schneider Electric EcoStruxure™ Power Monitoring Expert (PME)

Default version status: unaffected

  • Version 2022affected
  • Version 2023affected
  • Version 2024affected
  • Version 2024 R2affected

Schneider Electric EcoStruxure™ Power Operation (EPO) Advanced Reporting and Dashboards Module

Default version status: unaffected

  • Version 2022 w/ Advanced Reporting Moduleaffected
  • Version 2024 w/ Advanced Reporting Moduleaffected

References