Skip to content
CVE PROGRAM SOURCE RECORD1.0 Low

CVE-2025-8448

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
schneider

Description

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause unauthorized access to sensitive credential data when an attacker is able to capture local SMB traffic between a valid user within the BMS network and the vulnerable products.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Schneider Eelctric EcoStruxure Building Operation Enterprise Server

Default version status: unaffected

  • All 7.x versions to < 7.0.2.348affected
  • All 6.x versions to < 6.0.4.10001 (CP8)affected
  • All 5.x versions to < 5.0.3.17009 (CP16)affected

Schneider Electric EcoStruxure Enterprise Server

Default version status: unaffected

  • All 7.x versions to < 7.0.2.348affected
  • All 6.x versions to < 6.0.4.10001 (CP8)affected
  • All 5.x versions to < 5.0.3.17009 (CP16)affected

Schneider Eelctric EcoStruxure Building Operation Workstation

Default version status: unaffected

  • All 7.x versions to < 7.0.2.348affected
  • All 6.x versions to < 6.0.4.10001 (CP8)affected
  • All 5.x versions to < 5.0.3.17009 (CP16)affected

References