CVE-2025-0327
- State
- Published
- Severity
- 8.5 High
- Published
- Feb 13, 2025
- Updated
- Feb 13, 2025
- Reserved
- Jan 8, 2025
Description
CWE-269: Improper Privilege Management vulnerability exists for two services (of which one managing audit trail data and the other acting as server managing client request) that could cause a loss of Confidentiality, Integrity and Availability of engineering workstation when an attacker with standard privilege modifies the executable path of the windows services. To be exploited, services need to be restarted.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.5 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | schneider |
| 3.1 | 7.8 High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | schneider |
Weaknesses
- CWE-269 Improper Privilege Management
Affected Products
| Product | Versions |
|---|---|
EcoStruxure Process ExpertSchneider Electric |
|
EcoStruxure Process Expert for AVEVA System PlatformSchneider Electric |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.